Tech-debt batch 20: follow-ups — admin refusal reasons, OAuth refusal page, eager outbox serialization, refresh-family max age, token purge on user delete, bearer /me (#653–#658) - #671