The discover_tools endpoint was reading raw access tokens from stored
credentials without checking if they had expired. This caused users
to be prompted to re-authenticate every time the token expired (~1h).
Now uses creds_manager.refresh_if_needed() to transparently refresh
expired tokens before using them.