fix(auth): refresh tokens before authenticated requests

Move token refresh checks into the shared Rust connection/API path so long-running authenticated operations stop reusing stale access tokens. This covers recursive download and upload traversal, recursive ls via the shared APIs, and direct authenticated commands such as cp, mv, rm, and chacl.

Also surface HTTP failures earlier in the affected API methods instead of failing later during response parsing.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

src/api/laboratories.rs

@@ -9,8 +9,11 @@ struct LabListResponse {
 }
 
 impl MDRSConnection {
-    pub async fn list_laboratories(&self) -> Result<Laboratories, reqwest::Error> {
+    pub async fn list_laboratories(&self) -> Result<Laboratories, anyhow::Error> {
         let resp = self.get("v3/laboratories/").await?;
+        if !resp.status().is_success() {
+            anyhow::bail!("List laboratories failed: {}", resp.status());
+        }
         // The API may return a paginated object or a direct array
         let text = resp.text().await?;
         let items: Vec<Laboratory> =