fix(coderd/oauth2provider): answer invalid_grant when a refreshed token's key is gone - #28753

TL;DR

Last of three in PLAT-481, which closes PLAT-470. Refreshing a revoked token returned HTTP 500. refreshTokenGrant reads the api_keys row its token hangs off and returned that lookup's error raw, so sql.ErrNoRows fell past the sentinel dispatch to the generic handler, while every other missing row in the same function already answers invalid_grant.

• Diff is against fix: make OAuth2 refresh token redemption single-use under concurrency #28752, not main.
• No new sentinel, no new dispatch case, no migration, no docs: neither the error class nor the description charset is documented behavior.

The error class (FR12, AC13, AC14)

• Seven lines: sql.ErrNoRows from GetAPIKeyByID becomes errBadToken.
• The two revocation paths a client can reach both passed before this. Deleting the API key, and deleting the app secret, each cascade the oauth2_provider_app_tokens row away, so the prefix lookup answers errBadToken first. Their tests are here anyway: the property a client depends on is the response, not which statement notices it, and the cascades that make them pass are schema this function does not control.
• The case that moves is a token row whose api_key_id names no key. The FK cascade makes that unreachable through any API, so TestOAuth2RefreshKeyMissing disables the constraints to seed it, and takes a database of its own because disabling them applies to every table. 500 before, 400 after.
• FR12 names a third path, deleting the app. It never reaches the grant: the client_id no longer resolves, so ExtractOAuth2ProviderAppWithOAuth2Errors answers 401 invalid_client first. AppDeleted pins that, and the spec is corrected.

The charset (spec.md §19.2 finding 5)

• RFC 6749 §5.2 and OAuth 2.1 §3.2.4 restrict error_description to NQSCHAR, which excludes " (0x22) and \ (0x5C). %q emits both, and Tokens() passes err.Error() straight to WriteOAuth2Error, which does no rewriting.
• Three sites switch to the '%s' form the newer sentinels already use: errNoGrantableScope and errStaleScope in scopeStillCoveredByAllowlist, and errCoverageUndecidable in the shared firstScopeNotCovered.
• The authorize-only rejections keep %q. fix: deliver three more authorize errors to the client #28450 adds sanitizeErrorDescription on that side, which is where that endpoint's fix belongs; lifting it into WriteOAuth2Error for every endpoint is its own ticket.
• TestOAuth2TokenScopeErrorCharset drives all six scope rejections the token endpoint can produce and requires neither character in the description. Three of the six fail without the switch, which is what makes the table worth its length.

Stack: #28237, #28740, #28744, #28751, #28752, this PR.