fix: preserve existing refresh_token when server omits it in refresh response

Per RFC 6749 Section 6, issuing a new refresh token in the refresh
response is optional. Many OAuth providers omit it by default (Google,
Auth0 without rotation enabled, Okta in persistent token mode).

This fix checks if the refresh response omits refresh_token and preserves
the existing one to prevent auth failures after the first refresh.

Fixes modelcontextprotocol#2304

Author: Jah-yee

src/mcp/client/auth/oauth2.py

@@ -458,6 +458,17 @@ async def _handle_refresh_response(self, response: httpx.Response) -> bool:  # p
             content = await response.aread()
             token_response = OAuthToken.model_validate_json(content)
 
+            # Preserve existing refresh_token when server omits it in refresh response
+            # Per RFC 6749 Section 6, issuing a new refresh token is optional
+            if (
+                not token_response.refresh_token
+                and self.context.current_tokens
+                and self.context.current_tokens.refresh_token
+            ):
+                token_response = token_response.model_copy(
+                    update={"refresh_token": self.context.current_tokens.refresh_token}
+                )
+
             self.context.current_tokens = token_response
             self.context.update_token_expiry(token_response)
             await self.context.storage.set_tokens(token_response)