fix(core): reuse MCP OAuth refresh answers for spent tokens - #53275

Summary

Refresh tokens rotate: once the token server answers a refresh, the presented refresh token is spent. Concurrent refreshes of the same token already share one request, but that request was forgotten as soon as the answer arrived, before the new tokens were saved. A connection sharing the credential that read the stored token in that window sent the spent token itself and got a 429 or invalid_grant:

• A 429 makes the SDK abandon the refresh, and the server ends up needs_auth.
• invalid_grant asks us to drop the credential. The guard against dropping a newer token does not help when the new token has not been saved yet, so the user has to sign in again.

This hits hardest when access tokens expire together and every connection refreshes at once.

Fix. A successful refresh answer is now kept for 60 seconds, keyed by the spent token. A later refresh with that token gets the same answer, including the new tokens, without contacting the server. Failed answers are forgotten immediately, so a retry still reaches the server.

This covers every connection in one process. Coordinating refreshes across processes that share credential storage is out of scope.

Verification

• Checked against a local token server that rotates refresh tokens and rejects reuse:
  • Two concurrent refreshes share one request.
  • A later refresh with the spent token gets the saved answer without contacting the server.
  • A refresh with the new token reaches the server.
  • A failed refresh is not reused, and its retry reaches the server.
• bun test test/mcp.test.ts test/mcp-oauth.test.ts and bun run check pass.