INSTAGRAM-005 — Add token refresh, publishing reconciliation, and alerts

[daliu]

Outcome

Make the Instagram publisher maintainable without creating duplicate posts during token/provider failures.

Scope

• Refresh a valid long-lived token before expiry, validate the replacement against the expected account, then atomically promote it.
• Keep the last known-good token when replacement validation fails and alert owners.
• Reconcile existing container/recent account-owned media for stuck or outcome_unknown posts.
• Alert on expiry/refresh failure, schedule lag, stuck container, unknown outcome, quota pressure, provider restriction, and kill-switch activation.
• Document rotate/revoke/disconnect and staging pilot procedures.

Acceptance criteria

• Clock, refresh race, revoked token, provider error, secret-store failure, validation mismatch, overlapping scheduler, and redaction tests pass.
• A failed refresh never overwrites the known-good secret.
• Uncertain publish outcome requires manual resolution and never automatic republish.
• Primary/backup owner, alert channel, runbook, and emergency disable are established.
• First production post requires named owner approval after a test-account pilot.

Dependencies

#93 and coordinating backlog OBS-001.

Official references

• https://developers.facebook.com/documentation/instagram-platform/instagram-api-with-instagram-login/business-login
• https://developers.facebook.com/documentation/instagram-platform/instagram-graph-api/reference/error-codes

Coordination

Parent: #79

Do not begin implementation until dependencies are complete, this issue is assigned, and a timestamped CLAIMED comment naming the agent and branch is posted. Creation of this ticket is not a claim. Preserve the parallel agent work tracked by stable IDs in GITHUB_ISSUES.md.