fix(sync): remint access token in-process on events.list 401

[tyler-dane]

Summary

Staging incrementalPull jobs on connection 6a7250be… were failing Google events.list with HTTP 401 authError. PostHog reused the old “Sync job engine failed” fingerprint (calendarListSync/subscriptionMaintain ladders already cleared after #2635/#2696/#2712). #2729 classified those 401s as ProviderEventReadError(transient), so the worker retried the same cached access token up to 20 times and logged an error every attempt. #2754 later classified 401 as authExpired and invalidated the cache, but recovery still waited for the next job attempt — so a stale token still hit PostHog, and a dead/invalid grant still burned a retry before dropping.

This remints the access token in-process on the same events.list page (pull, import, and repair):

• Stale cached token → invalidate, refresh, retry the page. Job succeeds. No engine-failure log.
• Refresh invalid_grant / authorizationRevoked → dispatch drops the job and discards the credential so the connection asks for reconnect.
• Fresh token still 401 → treat as a dead grant (same drop), not 20 retries.

Ops for the current staging connection still applies: reconnect Google (or manage-failed-jobs if a row already exhausted). Deploying this stops the retry storm and the fingerprint reopen; it does not revive an already-revoked grant. #2748 (provider event identity collisions) is unrelated.

Simplicity

One helper (listEventPageWithAuthRetry) used by the three event-read engines. Reuses existing custody invalidateAccessToken + getValidAccessToken and the existing ProviderAuthError drop path. No new job states or health classes. No further simplification after the base-to-head pass — extracting the helper is the DRY boundary; inlining would triplicate the remint/drop contract.

Automated validation

• bun test:sync:fast -- packages/sync/src/domain/list-event-page-with-auth-retry.test.ts — 5 pass
• bun test:sync -- pull, dispatch, worker db tests — 62 pass
• import/repair db suites — green
• bun run lint — no new issues in touched files
• GitHub Test + CodeQL on the branch — success

Independent review

Fresh read-only review of main...HEAD: no confirmed findings.

Test plan

• Helper: success, transient rethrow, 401 then remint, refresh revoked, second 401 → dead grant
• Pull remints and applies after a one-off 401
• Dispatch completes after one-off 401; drops persistent 401 without engine-error logging
• Worker drops persistent 401 and does not call onError