fix(oauth): add backoff retry and consecutive confirmation threshold for invalid_grant