Exchanges a refresh token for a new access token carrying the same
claims, so a session outlives the 60-minute access token. Cognito is
the sole enforcer of the exchange: expiry, revocation and a disabled
account all end the session there.

No new refresh token is returned; the caller keeps the one issued at
sign-in until it expires. Every failure is answered with the same 401
Refresh token is invalid or expired.