Fix issue 468 for OneDive/Box + improved Google drive behavior (surfacing errors)

[Fulgan]

Partial fix for #468 — symptoms there were caused by several distinct bugs:

• Auth and cloud-sync failures were surfacing as "An unknown error occurred" in KeePass because the underlying exceptions had empty Message properties. Real status codes and AADSTS descriptions now reach the user.
• Per-account API clients were cached but not invalidated after re-auth, so re-authorized accounts kept using the previous (now-revoked) refresh token until KeePass restart.
• Microsoft rotates the refresh token on every refresh; the new value wasn't being written back to account.Secret, so the stored token went stale within minutes of the first OneDrive call in a session and most subsequent KeePass launches failed with invalid_grant.
• Token-expiry check used DateTime.Now but the SDK exposes AccessTokenExpiration in UTC, forcing unnecessary refreshes (and on the wrong direction of TZ offset, using stale tokens past their real UTC expiry).
• OneDrive content URLs of the form /items/{id}:/:/content 404 on personal accounts, and the SDK's itemWithPath() helper URL-encodes / so multi-segment paths can't be addressed through it. Path resolution now walks Items[id].Children segment by segment (with
  @odata.nextLink pagination so folders with >200 entries don't silently miss).
• The system-browser OAuth listener now reads the callback from either the query string or a form_post body — Microsoft's v2.0 endpoint uses the latter, which was silently failing as "Empty response".

What isn't fixed:

• The Google Drive symptoms haven't been verified because I can't reproduce them (I don't use GDrive), but the same error - surfacing improvements - were applied there so a future bug report will carry the real Graph error rather than a silent null.
• If/when a token expires, there is no UI to re-authenticate. The cloud connection must be removed and re-added.

Disclaimer: Claude Code was used to help with this PR