fix: make refresh_token optional in OIDC token exchange

Authentik may not return a refresh_token in the authorization_code
response. Use .get() instead of direct dict access to prevent KeyError.

apps/api/src/auth/oidc.py

@@ -47,7 +47,7 @@ async def exchange_code_for_tokens(
     payload = response.json()
     return {
         "access_token": payload["access_token"],
-        "refresh_token": payload["refresh_token"],
+        "refresh_token": payload.get("refresh_token"),
     }