feat: keep the Tiny connection alive and show when it is not

Connecting now asks for offline_access, retrying once without it if Tiny
refuses the scope. Renewal failures are stored: a refused refresh token
marks the connection lost and is not sent again (the Kanban previously
still said "conectado"), a transient failure shows as a warning until the
next renewal, and a session grant with under 12 hours left is flagged.
Tiny errors on the callback return to the Kanban instead of a 422.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ROADMAP.md

@@ -278,6 +278,17 @@ From the report already sent. These are dated promises, not backlog.
   `--confirmar`, through the worker's own `deliver`, then proves the duplicate
   guard by search first and only then by a second delivery. Not yet run
   against the client's account.
+  **Staying connected (2026-09-25):** Tiny documents a 4-hour access token and
+  a 1-day refresh token; the worker renews about every 4 hours. The connection
+  now asks for `offline_access` (listed by Tiny's Keycloak; if refused for this
+  application the callback retries once without it). Renewal failures are
+  stored: a refused refresh token marks the connection lost and is not retried,
+  a transient failure shows as a warning until the next success, and a
+  session grant with under 12 hours left is flagged. Previously a refused
+  refresh still showed "Tiny conectado". Whether Tiny grants offline access,
+  and whether a session grant has an undocumented maximum, is only known on
+  the client's account. There is no alert channel yet (no e-mail; WhatsApp
+  is fake): problems show on the Kanban only.
 - `[~]` 1.4 — Final print-file generation (see 3.2 and 3.6: production instructions
   must survive checkout before an output engine can reproduce the approved job).
   **Built (2026-09-24):** each paid item gets a PDF the width of the film and