Persist tokens to disk, preserving any stored client info.
Also records the absolute Unix-epoch expiry as a sidecar so a
cold-started provider can detect a stale access token and trigger
the SDK's refresh_token grant instead of a full browser re-auth.
Cleared when expires_in is absent so the sidecar can't go stale.
