fix(client): honor refresh during initial connect

[YuMo12268]

Summary

• Honor the Client's --refresh option during the initial credential connection.
• Refresh a valid cached credential directly instead of authenticating it first and refreshing it afterward.
• When the cached credential is unavailable or rejected, preserve the existing login fallback while requesting a refreshed credential with /login(refresh=true).
• Preserve the existing Client and Worker behavior when refresh is not requested.

Validation

• cargo fmt --all
• cargo clippy --workspace
• cargo build
• cargo doc
• Manually verified with a mock Coordinator that:
  • a valid cached credential with --refresh sends exactly one /refresh request, without /auth or /login;
  • a missing cached credential with --refresh sends one /login request with refresh=true;
  • a rejected cached credential falls back from /refresh to /login with refresh=true;
  • without --refresh, the existing /auth flow remains unchanged.