fix(auth): apply offline_access to reauth paths

[michaelneale]

Summary

Follow-up for #882 / SEP-2207 to ensure offline_access is applied beyond the initial authorization path.

• Applies add_offline_access_if_supported to step-up re-authorization scopes.
• Applies it to refresh-token scope requests when existing granted scopes are non-empty.
• Adds focused tests for both paths.

Testing

• cargo test -p rmcp --lib transport::auth --features auth,client,transport-streamable-http-client-reqwest

Closes #882.