fix(ticket-client): preserve tokenRefreshedAt on inline token refresh

[prithipalpatwal]

Summary

• Adds tokenRefreshedAt (ISO 8601 timestamp) to the SM secret payload written by OAuthCredentialManager#writeTokens() on inline token refresh
• Previously, auth-service wrote this field at OAuth callback time, but ticket-client's inline refresh overwrote the secret without it — the timestamp disappeared after the first inline refresh

Context

Found during alignment review of auth-service PR #595 against ticket-client PR #1701. The field is observability-only (not read by any code path), but ops tooling that inspects SM secrets to check token freshness loses the timestamp.

Test plan

• Existing test updated to verify tokenRefreshedAt is present and recent in written SM payload
• 200 tests passing, 100% coverage

🤖 Generated with Claude Code

[github-actions]

This PR will trigger a patch release when merged.

[MysticatBot]

Hey @prithipalpatwal,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Approve - clean, minimal observability fix with appropriate test coverage.
Complexity: TRIVIAL - single-line addition plus test, 2 files.
Changes: Adds tokenRefreshedAt ISO 8601 timestamp to the Secrets Manager payload written during inline token refresh, preserving the field that was previously lost after the first inline refresh (2 files).

Non-blocking (1): minor issues and suggestions

• nit: expiresAt is stored as epoch milliseconds while tokenRefreshedAt is an ISO string - the inconsistency is pre-existing (matching auth-service's format is correct here), but a one-line comment noting the intentional format difference would prevent a future reader from "fixing" it to match - oauth-credential-manager.js:453

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 0m 51s | Cost: $2.35 | Commit: f63ca5e20b4292046ca61f24c4b9a71cacd5de00
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[MysticatBot]

Hey @prithipalpatwal,

⚠ Degraded review - no spec document was found for this change (searched the PR links, the touched repos' docs, the architecture/guidelines docs, and linked Jira). This review covers code-level quality but could not validate the change against an agreed design, so confidence is reduced. Add a spec link (PR template section 4) and re-request review for a full-confidence pass.

Verdict: Approve - prior nit addressed with a clear inline comment; no new concerns.
Complexity: TRIVIAL - single-line addition plus comment, 2 files.
Changes: Adds a clarifying comment explaining the intentional format difference between expiresAt (epoch ms) and tokenRefreshedAt (ISO 8601) in the inline token refresh path (2 files).

Previously flagged, now resolved

• Format inconsistency between expiresAt (epoch ms) and tokenRefreshedAt (ISO string) - now documented with an inline comment explaining the intentional distinction.

---

_{Skill: pr-review | Model: us.anthropic.claude-opus-4-6-v1[1m] | Duration: 0m 54s | Cost: $1.90 | Commit: 98d903b88dafc85e3be58c9ede082336d1dc6f2f
If this code review was useful, please react with 👍. Otherwise, react with 👎.}

[solaris007]

🎉 This PR is included in version @adobe/spacecat-shared-ticket-client-v1.0.1 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀