auth: scrub refresh-token slot on logout

RemoveCurrentContext and RemoveAllContexts deleted only the access-token keychain slot, leaving the long-lived refresh token behind. After logout any keyring-capable process could still mint fresh access tokens from it. Delete both the access slot and its paired <service>:refresh slot.

Adds tokenstore.RefreshService() so the ':refresh' suffix lives in one place, and extends the logout tests to assert both slots are gone.