fix: make OAuth2 refresh token redemption single-use under concurrency - #28752

TL;DR

Second of three in PLAT-481. Two concurrent refreshes of one refresh token both minted a replacement. #28744 fixed the same bug on the authorization code; this applies it to api_keys, so the review is a comparison against a merged precedent.

• Diff is against feat: let an OAuth2 refresh narrow the granted scope #28751, not main.
• No migration.

The fix

• A refresh deletes the API key the presented token hangs off and mints a replacement. That delete was a blind :exec with no affected-rows check, so the request that lost the race deleted nothing and minted anyway.
• DeleteAPIKeyByIDReturningRow is the same DELETE ... RETURNING * shape as its code-side sibling: a delete that removed nothing surfaces sql.ErrNoRows. RETURNING * because fetchAndQuery needs an rbac.Objecter.
• refreshTokenGrant maps that to errBadToken, the invalid_grant it already returns for a token it cannot find, per RFC 6749 §10.5.
• The seven other DeleteAPIKeyByID call sites are untouched, including authorizationCodeGrant's previous-key delete, where the code delete already arbitrates single use and a returning-row delete would imply otherwise.

Tests

• TestOAuth2RefreshSingleUse races two refreshes on one barrier and requires exactly one 200 and one 400 invalid_grant. A sequential pair passes pre-fix, so the race is the test; the barrier shape is now shared with TestOAuth2TokenExchangeSingleUse as requireExactlyOneMinted.
• An APIKey subtest in the existing TestSingleUseDeleteByIDReturningRow pins the second delete returning sql.ErrNoRows.
• MethodTestSuite fails on any untested database.Store method, so DeleteAPIKeyByIDReturningRow gets a case alongside DeleteAPIKeyByID.

Stack: #28237, #28740, #28744, #28751, this PR.