authenticate to booksy's public api and manage its short-lived oauth2 access and refresh tokens

Steps

1. request sandbox and production api credentials from booksy — booksy's public api docs (docs.booksy.com) describe separate rsa key pairs for each environment, so don't reuse one environment's keys in the other
2. review the oauth2 authorization flow (including openid id token support) documented at docs.booksy.com before writing client code, since booksy's public api is a rest api organized around resource-oriented urls with json responses
3. exchange your credentials for a short-lived access token and a refresh token through the documented token endpoint
4. implement proactive token refresh logic: booksy's published docs describe access tokens on the order of minutes and refresh tokens on the order of days, so refresh well before either expires rather than waiting for a 401
5. use the resulting bearer token to call booksy's rest endpoints for bookings, appointment status updates, service details, and client profiles