Silent refreshes, token rotation, postMessage flow — what the docs skip and what I learned in production.