### Check for existing issues

- [x] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

The `.well-known/oauth-authorization-server` metadata advertises `"grant_types_supported": ["authorization_code", "refresh_token"]` (added in PR #19738), but `exchange_token_with_server()` in `discoverable_endpoints.py` only accepts `authorization_code` and returns HTTP 400 for any other grant type.

This means MCP clients (e.g. Claude Code) that follow the standard OAuth2 refresh flow (RFC 6749 §6) cannot refresh expired tokens — they get repeated 400s and must re-authenticate from scratch.

The `token_endpoint()` function also doesn't accept `refresh_token` as a form parameter, so it can't even be forwarded to the upstream MCP server.

This affects any OAuth2 MCP server with token rotation (e.g. Slack, which rotates tokens every 12 hours).

**Note:** We're aware of the server-side credential storage + refresh approach in commit 9b78cf7d1e, but that's for the LiteLLM UI flow. MCP clients that manage their own token lifecycle (per the OAuth2 spec) need the token endpoint to support the `refresh_token` grant.

### Steps to Reproduce

1. Configur…