fix(auth): keep the refresh token the provider hands back

The reply to a refresh carries a new refresh token and the provider
stops honouring the one that was sent. Only the access half was read,
so the cache kept re-sending a token the server had already retired.

- deserialize the refresh half and write it back to the cache, as an
  Option so a provider that does not rotate leaves the stored one be
- bound the refresh request on its own: the caller holds a lock that
  spans processes while it runs, so a provider that goes quiet would
  stall every other request on the machine
- give config create/update one rule for what a remote URL is, and
  store it without the trailing slash, matching the Python client so
  the two can share config.ini; this drops the validators crate and
  77 transitive dependencies with it
- join the base URL and the API's relative download path with the
  separator neither of them carries, as download.rs already does

src/cache/mod.rs

@@ -387,10 +387,13 @@ async fn refresh_and_persist_in_dir(
         .ok_or_else(|| anyhow!("Remote `{}` is not configured.", remote))?;
     let conn = MDRSConnection::new(&url);
 
-    let new_access = conn.token_refresh(&cache.token.refresh).await?;
+    let refreshed = conn.token_refresh(&cache.token.refresh).await?;
 
     let mut updated_cache = cache.clone();
-    updated_cache.token.access = new_access;
+    updated_cache.token.access = refreshed.access;
+    if let Some(refresh) = refreshed.refresh {
+        updated_cache.token.refresh = refresh;
+    }
     updated_cache.digest = compute_digest(
         updated_cache.user.as_ref(),
         &updated_cache.token.access,