fix(oauth2ac): don't signal spurious refresh on first authorization

[waynz0r]

Summary

• Authorize checked syncGate.IsOpen() both before and after storeTokenAndAuthorize, but that call opens the gate as a side effect (via setAuthorizedStatus), so the post-check always read true — even on the very first authorization.
• This caused signalRefresh() to fire spuriously on first-time auth, making tokenRefresherLoop immediately replace the token it just published and emit a bogus RemoveEventType credential event right after the initial Update.
• Fix: capture syncGate.IsOpen() once before the token is stored, and use that captured value for both the early-return check and the post-store refresh-signal decision, so refresh is only signaled on genuine re-authorization.