fix: retry recovered credential decrypt failures

[Avilianb]

Summary

• Retry a manually requested credential refresh when its only permanent marker is credential_decrypt_failed.
• Include those recovered reauthRequired credentials in the bulk refresh candidate set.
• Preserve the permanent block for genuine OAuth failures such as invalid_grant.

Root cause

A temporary credential-encryption-key mismatch can mark a valid refresh token as permanently failed. After the correct key is restored, both manual and bulk refresh paths still stopped before attempting a refresh.

Validation

• go test ./internal/application/account -run '^(TestCredentialRefreshFailureDistinguishesTransientAndPermanent|TestRefreshTokenRetriesRecoveredCredentialDecryptFailure|TestRefreshAllTokensRetriesRecoveredCredentialDecryptFailures|TestRefreshAllTokensSkipsUnrefreshableAccounts)$' -count=1
• go test ./internal/infra/persistence/relational -count=1 was attempted, but an unrelated Windows temporary-directory cleanup error occurred in TestBuildSuperEntitledNonBuildForcedFalse after the tests ran.