fix(gitlab): refresh expired tokens for GraphQL and REST 401s

[jackspiece]

Summary

Fixes #7931.
Related to #7581.

#7854 added refresh and retry behavior for GitLab REST requests, but Apollo HTTP Link still called fetch directly. If the first request after a PKCE access token expired was GraphQL, GitLab returned a 401 and the stored refresh token was never used.

This routes Apollo through the existing backend request function and recognizes the documented GraphQL invalid-token response. That keeps refresh coalescing, credential persistence, and the single retry in the same path used by REST.

While checking #7581, I also found that GitLab REST APIs use {"message":"401 Unauthorized"} for invalid credentials. The existing detector only recognized the OAuth invalid_token shape. This now recognizes both exact REST responses, so an expired token can also be refreshed during the initial /user request.

Test plan

• Added a regression test that returns a GraphQL 401 for the expired token, verifies one refresh, retries with the rotated token, and checks the new credentials are stored.
• Covered both the OAuth invalid_token body and GitLab's standard REST 401 body, including refresh during login.
• Focused GitLab backend suite: 25 tests and 2 snapshots passed.
• Full verification:
  • formatting and ESLint passed
  • TypeScript check passed
  • 104 test suites passed, 2 skipped
  • 1,313 tests passed, 1,304 skipped
  • 138 snapshots passed

Checklist

• I have read the contribution guidelines.

[jackspiece]

The current e2e run did not report an assertion failure. Cypress stopped emitting output in media_library_spec_git-gateway_gitlab_backend_large_media.js, then the outer 30-minute process timer killed it 21 minutes later. That spec exercises the separate Git Gateway backend; it completed in 36 seconds on the previous head 45f0acf, and all current build and unit matrices pass.

I tried to rerun the failed job, but fork authors do not have the required repository permission. Could someone with Actions access rerun e2e?

[yanthomasdev]

Thanks @jackspiece! The failing test is a flaky test we already had and is unrelated to your PR, I'll rerun checks but the PR looks good to me.

[netlify]

✅ Deploy Preview for decap-cms ready!

Name	Link
🔨 Latest commit	d19a2a2
🔍 Latest deploy log	https://app.netlify.com/projects/decap-cms/deploys/6a8c94633e02d20007e3a892
😎 Deploy Preview	https://deploy-preview-7932--decap-cms.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.