feat(slack): classify broker refresh failures

[mohammedahmed18]

Summary

• Preserves sanitized permanent Slack refresh failures through the OAuth broker.
• Decodes nested OAuth-service error envelopes in locality-slack while retaining legacy flat-envelope compatibility.
• Adds service and client coverage for invalid-grant, authorization/scope, retryable upstream failures, and redaction.

Dependency

Required by the internal Slack broker worker PR so revoked/rotated credentials are classified as reconnect-required rather than retried indefinitely.

Verification

• npm test and npm run typecheck in apps/oauth-service
• cargo test -p locality-slack --locked (100 passed)
• cargo fmt --check and git diff --check

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
locality	Ready	Preview	Aug 29, 2026 2:31pm