Adds integration guidance that refresh-token exchange may fail after provider-side client scope policy is narrowed.