feat: add durable QuickBooks OAuth refresh

[xinfantry4lifex]

Scope

• Replace the expiring static QuickBooks access token path with refresh-token support.
• Keep QuickBooks reads and estimate drafts bound to the enrolled realm.
• Preserve human approval before every draft creation.
• Document required Intuit and Vercel configuration.

Acceptance

• Refresh succeeds once and retries the original request once after a 401.
• Invalid refresh credentials fail closed without external writes.
• Tests cover refresh success, refresh failure, and approval controls.
• Production remains disabled until owner OAuth enrollment and verification finish.