Safer recovery from interrupted subscription refreshes

Successful refreshes still save their new tokens even when storage is slow. If an interrupted attempt never finishes, reconnect that subscription in Your credentials rather than wait for another automatic retry. We treat a timeout as an unknown outcome because the provider may already have rotated the token.