DAOAuth credential refresh doesn't work properly

[jpagh]

Summary

DAOAuth does not silently refresh expired OAuth credentials before applying
header-based authorization to DAWeb requests.

Problem

DAOAuth.get_credentials() only re-authorized when credentials were missing or
marked invalid. Expired-but-refreshable credentials could be returned
unchanged, and DAOAuth.authorize() would then apply the stale bearer token to
request headers.

In addition, RedisCredStorage.locked_get() reconstructs credentials from JSON
without restoring their storage reference. That means refreshed tokens cannot be
persisted automatically after a Redis round-trip.

Expected behavior

Stored OAuth credentials should:

• reload with their storage attached
• refresh silently when expired and refreshable
• persist refreshed tokens back to Redis
• report expired or un-refreshable credentials as unauthorized instead of sending
  stale bearer tokens

Actual behavior

Expired credentials could still be treated as authorized and sent as-is on the
header-based DAWeb path.

Fix

• Reattach storage when Redis-backed credentials are reloaded.
• Refresh expired credentials in DAOAuth.get_credentials() before they are
  returned.
• Treat expired credentials as unauthorized in get_credentials() and
  is_authorized() when refresh is unavailable or fails.

[jpagh]

In my experience using this with Clio, I have to re-authenticate every so often (I think their tokens are 30 days now). But I have other services that use OAuth to connect to Clio that NEVER ask me to re-authenticate. This led me to believe that there was a bug with the DAOAuth code, and this bug report/PR is the result of that investigation.