feat: keep the Tiny connection alive and show when it is not

Connecting now asks for offline_access, retrying once without it if Tiny
refuses the scope. Renewal failures are stored: a refused refresh token
marks the connection lost and is not sent again (the Kanban previously
still said "conectado"), a transient failure shows as a warning until the
next renewal, and a session grant with under 12 hours left is flagged.
Tiny errors on the callback return to the Kanban instead of a 422.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/api/operator.py

@@ -316,12 +316,21 @@ def tiny_test(user=Depends(operator)):
     return {'ok': all(v == 'ok' for v in results.values()), 'results': results}
 
 @router.get('/api/operator/tiny/callback')
-def tiny_callback(code: str = Query(max_length=4096), state: str = Query(max_length=128)):
+def tiny_callback(code: str = Query('', max_length=4096), state: str = Query('', max_length=128),
+                  error: str = Query('', max_length=128)):
     """Tiny's redirect back. Cross-site, so the operator cookie is absent: the
-    single-use state an operator created is what authorises it."""
+    single-use state an operator created is what authorises it. Tiny reports a
+    refusal (the operator declined, or offline access is not allowed for this
+    application) with `error` instead of a code."""
     if not tiny.configured():
         raise HTTPException(503, 'Tiny application is not configured')
     try:
+        if error == 'invalid_scope':
+            retry = tiny.TinyAuth().without_offline(state)
+            audit('tiny_offline_refused')
+            return RedirectResponse(retry, status_code=303)
+        if error or not code:
+            raise tiny.TinyError(f'Tiny returned {error or "no code"}')
         who = tiny.TinyAuth().complete(code, state)
     except tiny.TinyError:
         audit('tiny_connect_failed')