feat(auth): force token refresh on rejected token (401/403), never the browser

[wpfleger96]

Agents were silently dying mid-turn against Databricks. The root cause was a broken token refresh: a cached token the provider rejected was never actually replaced, so the agent re-sent the dead token, got rejected again, and died with no recovery. This PR closes that, plus a related multi-process refresh race. It carries two halves — flagging the first explicitly because it has never been independently reviewed.

Half 1 — multi-process refresh race in bearer() (commit 408d1da5, not previously reviewed)

Multiple buzz-agent processes share one OAuth cache file. When the access token expires they all race to refresh, and Databricks rotates refresh tokens — so the first process to refresh invalidates the old one, and the losers' refresh grants previously fell through to browser_pkce_flow, causing repeated browser auth prompts (a headless hang).

bearer() now re-reads the disk cache before attempting a refresh (picks up a token a sibling already wrote) and again after a refresh failure (catches a sibling that won the race between our check and our failed attempt). The endpoints() discovery call is hoisted so it runs at most once per bearer() invocation. This commit was developed separately and ships here for the first time; it inherits this PR's review.

Half 2 — force refresh on a rejected token, keyed by token identity

A cached token can be rejected by the provider before its local expiry clock says it is stale — clock skew, server-side revocation, or a load-balancer node that never saw it. The original refresh_now() gated the refresh grant on is_expired(), so on a locally-fresh-but-rejected token it returned the same dead token unchanged. The agent re-sent it, was rejected again, and died. This was the actual cause of the silent deaths.

• TokenSource::refresh_now(&self, rejected: &str) — a new trait method that takes the rejected access token and coalesces on token identity, not the expiry clock. It holds the cache lock for the whole re-check -> refresh -> save sequence. Under the lock: if the cached token no longer equals rejected, a sibling already refreshed -> return it (true coalesce); otherwise it is still the rejected token, so run the refresh-token grant unconditionally. is_expired() is gone from the method entirely. It runs the refresh-token grant only — never browser_pkce_flow — and on a dead refresh token returns a terminal LlmAuth rather than hanging a headless harness. The refresh token is preserved, never nulled.
• post() status mapping — both 401 and 403 map to LlmAuth and are treated as refreshable. A 403 can mean a revoked/expired token (Databricks and OAuth gateways return 403 for this), indistinguishable from a pure-authorization 403 at the HTTP layer. The identity-coalesce design is what makes retrying a 403 safe: the retry sends a genuinely fresh token instead of re-sending a dead one.
• post_openai one-shot retry — on the first LlmAuth it calls refresh_now(&rejected) and retries post() once. A second LlmAuth propagates terminally. The guard is a local bool scoped to the single call, so an earlier turn's rejection can never suppress a later turn's legitimate retry, and a persistent rejection is bounded to one grant + one retry. This seam covers all three OpenAI-family paths (/responses, /chat/completions, and the auto-upgrade).
• StaticTokenSource uses the trait default — refresh_now() returns the static key unchanged, since a static key can't refresh and one harmless retry is fine.

Tests

• refresh_now_runs_grant_on_unexpired_rejected_token — the proof test for the core bug: an unexpired cached token (expires_at = now+3600) that equals the rejected token forces the grant to run exactly once, the returned bearer differs from the rejected one, no browser, refresh token preserved (rotated). This test fails against the old expiry-clock gate and passes now.
• refresh_now_coalesces_when_another_caller_already_refreshed — an unexpired cached token that differs from the rejected one short-circuits with zero grants, proving coalesce is identity-keyed, not clock-keyed.
• refresh_now_without_refresh_token_is_terminal — no refresh token -> terminal LlmAuth, no browser, no grant.
• post_openai_refreshes_once_per_call_on_401 — one 401 -> exactly one refresh + successful retry; a later call gets its own refresh (guard is per-call).
• post_openai_persistent_401_propagates_after_one_retry — a token the refresh can't satisfy propagates LlmAuth after exactly one refresh (no loop).
• post_openai_refreshes_once_on_403 — a 403 on the stale token, 200 on the fresh one: proves a 403 enters the refresh path and recovers after exactly one refresh.
• post_openai_persistent_403_propagates_after_one_retry — always-403 -> terminal LlmAuth after exactly one retry, bounding a pure-authorization 403; the regression guard against re-narrowing the mapping to 401-only.
• static_token_source_refresh_now_returns_static_token — default impl returns the key.
• Plus the two existing bearer() race-fix tests from Half 1.