Fixes, readme

Drop cli-proxy-api token handling, use only native Claude credentials.
Simplify refresh to single endpoint (platform.claude.com) with scope.
Add debug/refresh and debug/shutdown endpoints. Graceful shutdown.

internal/auth/selector.go

@@ -54,5 +54,49 @@ func (p *Pool) MarkSuccess(cred *Credential) {
 }
 
 func (p *Pool) RefreshExpiring(ctx context.Context) {
-	refreshAll(p)
+	refreshExpiring(p)
+}
+
+func (p *Pool) RefreshAll(ctx context.Context) []map[string]string {
+	p.mu.Lock()
+	creds := make([]*Credential, len(p.creds))
+	copy(creds, p.creds)
+	p.mu.Unlock()
+
+	var results []map[string]string
+	for _, cred := range creds {
+		cred.mu.Lock()
+		id := cred.ID
+		email := cred.Email
+		oldExpiry := cred.ExpiresAt
+		hasRefresh := cred.RefreshToken != ""
+		cred.mu.Unlock()
+
+		r := map[string]string{
+			"id":         id,
+			"email":      email,
+			"old_expiry": oldExpiry.Format(time.RFC3339),
+		}
+
+		if !hasRefresh {
+			r["status"] = "skipped"
+			r["reason"] = "no refresh token"
+			results = append(results, r)
+			continue
+		}
+
+		err := RefreshToken(ctx, cred)
+		if err != nil {
+			r["status"] = "error"
+			r["error"] = err.Error()
+		} else {
+			cred.mu.Lock()
+			r["status"] = "ok"
+			r["new_expiry"] = cred.ExpiresAt.Format(time.RFC3339)
+			r["new_token_prefix"] = cred.AccessToken[:20] + "..."
+			cred.mu.Unlock()
+		}
+		results = append(results, r)
+	}
+	return results
 }