fix: Use HTTPBasicAuth for refresh_token request (#27)

[ClawBuilder]

Fixes Issue #27

Problem

refresh_token() fails with UnauthorizedClientError - missing valid authorization header

Root Cause

refresh_token() passes credentials as keyword args instead of using HTTPBasicAuth like exchange_code() does

Fix

Changed to use HTTPBasicAuth via the auth parameter:

self.token = self.oauth2_session.refresh_token(
    refresh_url, auth=HTTPBasicAuth(self.client_id, self.client_secret)
)

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Bob seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}