Add expiring offline access token support

[zzooeeyy]

• https://github.com/shop/issues-app-access/issues/791

What

Adds support for expiring offline access tokens with refresh tokens.

Related change in shopify_app gem:

• Add expiring offline token support shopify_app#2027

Why

Enables apps to use time-limited offline access tokens for improved security through automatic token rotation.

Changes

Core Features:

• New config option: expiring_offline_access_tokens in Context setup
• Extended Session class with refresh_token, refresh_token_expires, and expiration helpers (expired?, refresh_token_expired?)
• ShopifyAPI::Auth::RefreshToken.refresh_access_token - Exchange refresh token for new access token
• ShopifyAPI::Auth::TokenExchange.migrate_to_expiring_token - Migrate existing non-expiring tokens to expiring tokens (one-time, irreversible per shop)

OAuth Flows:

• Authorization code grant and token exchange automatically request expiring tokens when config is enabled
• HttpClient now serializes OAuth error responses (error, error_description) for better error messages

Error before	Error after

[lizkenyon]

Nit: Let me know what you think

Because the error and error_description fields are specific to oauth requests I wonder if we could move this logic to a file where it make that more explicit.

For example, in RefreshToken or TokenExchange:

  rescue ShopifyAPI::Errors::HttpResponseError => e
    # Parse OAuth-specific error from response.body
    oauth_error = e.response.body["error"]
    oauth_description = e.response.body["error_description"]
    # Re-raise with better message or handle specifically
  end

[zzooeeyy]

I slightly disagree on this since http_client is a generic class we provide in the library, it should be able to handle errors and be able to serialize it regardless of where it came from. Apps could use HTTPClient to implement their own OAuth strategy which they would now have to parse specific errors from the response themselves as well.

[lizkenyon]

I think that is a fair point. I don't feel too strongly either way so I am good to leave it as is. 👍