feat: revalidateSession for non-rotating authority remint (CEL-1853)

[mong-x]

Summary

• Adds ConcreteAuthStore.revalidateSession and optional revalidatePath (default /auth/revalidate).
• Single-flights concurrent remints; joins in-flight refresh/adoption; preserves absolute refresh deadline/timer.
• One ACCESS_TOKEN_EXPIRED fallback to ordinary refresh; no generic 401/403/503/network fallback.
• Version bump to 0.16.0 (not published by this PR).

Linear

CEL-1853

Test plan

• npm test (183 passing) including new session-resolution cases
• npm run typecheck
• Publish 0.16.0 before importer pin/adoption

---

Summary by cubic

Adds ConcreteAuthStore.revalidateSession and optional revalidatePath (default /auth/revalidate) so sessions can be reminted without spending the refresh cookie, fixing the session revocation seen on legacy offer Back navigation (CEL-1853). Concurrent remints are single-flight, join in-flight refresh/adoption, and preserve the absolute refresh deadline. Falls back to ordinary refresh only once on ACCESS_TOKEN_EXPIRED; generic 401/403/503/network errors return unauthorized or unavailable without refresh. Bumps @cellarnode/auth to 0.16.0 (not published in this PR).

^{Written for commit 4d4426a. Summary will update on new commits.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}