csm: add Zalo refreshToken and fix broadcast header string

Expose POST /mscsm/user/refresh-token for Host BFF and send is-broadcast-event as string so gateway headers stay valid.

Co-authored-by: Cursor cursoragent@cursor.com