Expose refreshable on CredentialItem (#67)

## Summary

`GET /v1/credentials` returns a new `refreshable` field per credential:
`True` when a live refresh token can still mint a replacement for that
credential.

The endpoint also now includes an expired credential while that flag
holds. Previously an agent idle past its 24h access expiry disappeared
from the list entirely even though its 90-day refresh token could still
renew it, so there was nothing left to revoke. Callers that render the
list should treat `refreshable` as "this credential can still come
back", and can filter on `expires_at` themselves if they want only
currently-valid access tokens.

Version bumped to 2.6.0: additive optional field, no caller has to
change anything. Matches the node-sdk change field for field.

## Type of change

- [ ] Bug fix (no breaking change)
- [x] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [ ] Docs, tests, or internal maintenance only

## Public API

`CredentialItem` gains `refreshable: NotRequired[bool]`. Optional, so a
client pointed at a build that does not emit it still type-checks and
reads as absent. No signature or wire-format change; no migration
required.

Worth knowing even though it is not a type change: the list can now
contain credentials whose `expires_at` is in the past. Code that assumed
every returned credential was currently valid should check `expires_at`
rather than assume.

## Test plan

`test_list_credentials_success` covers both wire shapes: a credential
carrying `"refreshable": False`, and one omitting the key entirely
(asserting `.get()` returns `None` rather than raising). Reproduce with
`uv run pytest`.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

agentscore/types.py

@@ -420,6 +420,10 @@ class CredentialItem(TypedDict):
     created_at: str
     expires_at: str | None
     last_used_at: str | None
+    # True when a live refresh token can still mint a replacement for this
+    # credential. An expired credential is listed only while this holds, since
+    # revoking it is what stops the renewal.
+    refreshable: NotRequired[bool]
 
 
 class _CredentialCreateResponseRequired(TypedDict):

pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "agentscore-py"
-version = "2.5.3"
+version = "2.6.0"
 description = "Python client for the AgentScore APIs"
 readme = "README.md"
 license = "MIT"

tests/test_client.py

@@ -1245,6 +1245,7 @@ def test_create_credential_raises_on_error():
             "created_at": "2024-01-01T00:00:00Z",
             "expires_at": "2024-04-01T00:00:00Z",
             "last_used_at": None,
+            "refreshable": False,
         },
         {
             "id": "cred_def456",
@@ -1266,6 +1267,10 @@ def test_list_credentials_success():
     assert len(result["credentials"]) == 2
     assert result["credentials"][0]["id"] == "cred_abc123"
     assert result["credentials"][1]["id"] == "cred_def456"
+    assert result["credentials"][0]["refreshable"] is False
+    # Optional on the wire: a credential listed by an older API build carries no
+    # such key, and reading it must not raise.
+    assert result["credentials"][1].get("refreshable") is None
 
 
 @respx.mock