fix: address Phase 6 code review feedback
- Remove stale #[allow(dead_code)] from RefreshTokenRow.did field (db/oauth.rs:252) — the field is used in production code in oauth_token.rs when passing did to issue_access_token and store_oauth_refresh_token
- Remove stale #[allow(dead_code)] from TokenRequestForm.refresh_token field (oauth_token.rs:42) — the field is now used in handle_refresh_token at line 362 during Phase 6 refresh_token grant handling
- Add assertion to consume_oauth_refresh_token_returns_row_and_deletes_it test in db/oauth.rs to verify did field is correctly retrieved from database, completing the field coverage check for the RefreshTokenRow struct