Skew window: re-mint when within this many ms of expiry.
Returns a valid access token, minting/refreshing only when the cache is
empty or near expiry. grant selects which flow to run; pass
'refresh_token' as the primary and 'password' as the documented
fallback when no refresh token is available.
Clears the cached token (e.g. on a 401, or when the bound config changes).
Stateful per-connection OAuth2 token manager. One instance caches one access token; a connector typically holds a single manager and resets it when the bound connection/config changes.