implement ebay oauth user-token flow with refresh tokens

Steps

1. Redirect the user to eBay's authorization endpoint with query parameters: `client_id`, `redirect_uri` (your RuName registered in the developer portal), `response_type=code`, and `scope` (space-separated list of required scopes).
2. After user consent, eBay redirects to your `redirect_uri` with a `code` parameter; exchange it for tokens by POSTing to eBay's token endpoint with `grant_type=authorization_code`, `code`, and `redirect_uri`, using HTTP Basic Auth with your client ID and secret.
3. Store the returned `access_token` (short-lived, typically 2 hours) and `refresh_token` (long-lived, typically 18 months) securely, associated with the user.
4. When the access token expires (check the `expires_in` field or catch a 401), obtain a new one by POSTing to the token endpoint with `grant_type=refresh_token` and `refresh_token`.
5. If the refresh token itself expires or is revoked, re-initiate the full authorization flow — detect this when the refresh token exchange returns an error.
6. For application-level calls that don't require user context, use the client credentials grant (`grant_type=client_credentials`) to obtain an application token.