Don't call a login expired after one failed check

Styx connects to Vercel, AWS, Supabase and others through the logins you already have, and agents ask to use them. A login can expire without telling anyone, so Styx checks every connected target every 30 minutes, when you bring the app to the front, and when the computer wakes.

The obvious version of that is easy to get wrong: a check fails, so mark the target expired. But a check also fails when the wifi drops, or when the laptop has just woken up and has no network yet. Mark it expired then, and you've told the user their login is broken when it isn't.

So the two kinds of failure are treated differently. A brief network failure doesn't count. Only a real authentication failure counts, and it has to show up in two checks in a row. The exceptions are when you press Refresh, or when a grant can't be issued because the CLI is signed out. Those count the first time, because you've just asked.

When a target is marked expired, an agent that asks for it gets an error telling it to reconnect in Styx. Once you sign in again, every other target on the same account is checked again, so one login clears all of them.

The trade-off is delay: a real expiry can go unnoticed for a while, since the checks are 30 minutes apart. I'd rather have that than a false alarm that pauses an agent.