This page owns the OAuth flow and refresh-token storage. The Meerkat WASM runtime never sees the refresh token — it asks the page for a structured bearer lease when it needs one.