fix: Generate a new refresh token if an instance domain was changed

[shepilov]

After migrating an instance from one domain to another (e.g., alice.mycozy.cloud → alice.twake.app), sharings between migrated and non-migrated instances can break.

When the migration is done by:

1. Changing the instance's Domain attribute
2. Setting OldDomain to the previous domain value

The OAuth tokens behave as follows:

• Refresh token: Still has iss: "alice.mycozy.cloud" (old domain)
• Access token: After refresh, has iss: "alice.twake.app" (new domain)

However, after a successful refresh:

1. A new access token is generated with the current domain as issuer ✅
2. The refresh token is NOT regenerated ❌

This means the client continues using the old refresh token. While this works as long as OldDomain is set, it's fragile, and the refresh token should be updated to use the current domain.