fix(realtime): refresh tokens in background and clear on disconnect (#201)

The active state had no handler for token expiry, so tokens
were never refreshed. Replace the broken expireToken approach
with a recurring background fetch that updates the token
in-place via a new authenticated transition, keeping the
WebSocket open. Use a generation counter to prevent stale
callbacks from spawning parallel refresh loops. Also expire
the token on connectionClosed and close so reconnects always
re-authenticate instead of reusing a stale token.