getRefreshTokenForPersistence

Returns the in-memory refresh token snapshot, without consulting AccountManager. Intended for persistence call sites that are about to write a refresh token to storage (account creation, update, token migration, duplicate user reconciliation). Using getRefreshToken at those sites would read back the value currently persisted in AccountManager — i.e. the value we are about to overwrite — instead of the value the caller built this UserAccount with.