Get an OAuth2 access token from service account credentials.

Accepts credentials in multiple formats:

• File path (string) - if file exists, reads and parses JSON file
• JSON string (string) - if not a file, parses as JSON directly
• Map - uses as-is (already parsed, normalizes atom keys to strings)

Generates a fresh token on each call. Tokens are valid for 1 hour.

Returns {:ok, access_token} or {:error, reason}.