fix(core): serialize MCP OAuth refreshes across processes - #50994

Fixes #34520.

Problem

MCP OAuth credentials live in one global row that every opencode process shares: the background server, each opencode acp, and run --standalone. When the access token expires, two processes can refresh at once with the same refresh token. The authorization server rotates it for the first request and rejects the second with invalid_grant. Servers with refresh-token reuse detection go further and revoke the whole token family, so every process ends up in needs_auth and the user has to log in again.

Within one process, concurrent refreshes already share a single request. Across processes, nothing coordinates them.

Change

• SDK patch. Adds an optional withRefreshLock(refresh) hook to OAuthClientProvider. The SDK runs its read-tokens, refresh, save-tokens sequence inside that hook. Providers that don't implement it are unchanged.
• MCP provider. The provider for a stored credential implements the hook with the existing EffectFlock lock, keyed by credential ID. Because tokens() runs inside the lock, a process that waited reads the refresh token the previous holder just saved. It never replays the old one.

The hook sits in the SDK because every refresh happens there, triggered by a 401, a step-up or a retry after invalid_grant. Wrapping only our own call sites would leave those paths unlocked.

A compare-and-swap on the row, as the issue suggests, would keep the stale refresh from overwriting good tokens. But the stale refresh request would still reach the authorization server, and that request is what triggers reuse detection. Only serializing the refresh stops it.

What this wins

• Parallel processes no longer knock each other into needs_auth when a shared token expires.
• Servers with reuse detection no longer revoke the token family.

Tests

• New test: two providers share one credential row, as two processes would, and refresh concurrently. The second refresh presents the rotated token. With the lock removed, the test fails because both refreshes present the same token.
• packages/core: MCP, MCP OAuth and integration suites pass (116 tests). bun run check passes.