Return a currently-valid access token, minting or refreshing if needed.
Called before every authenticated request, so implementations should be cheap on the common path — see caching, which makes that so.