fix: never resurrect auth.json after sign-out (refresh race)

[vreshch]

A token refresh whose mutateAuth re-read came back null was folding the in-memory auth back onto disk (current ?? auth), so a sign-out that landed while the refresh was on the wire got its auth.json written straight back - the session the user just ended came back alive, violating mutateAuth's own documented contract ("leave a null re-read null"). The refresh mutator now returns null on a null re-read (the in-flight request still retries with the fresh tokens in memory; nothing is persisted), and deleteAuth takes the same withFileLock the mutate path uses so sign-out can no longer interleave with someone else's read-modify-write. Its single caller (setup.ts disconnect) already ran in an async context. Regression cover: a deterministic sign-out-during-refresh case plus a 50-iteration race loop (both fail on the old code), and a lock-contention test for deleteAuth.

Closes #236

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: ffe6f20ca00ff8ab413938191461068043a77e20
Branch: bugfix/auth-refresh-resurrect

Checks:

• ✅ Release guard (no version/changelog changes)
• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful

Ready to merge! ✨

---

🔗 View workflow run
⏰ Generated at: 2026-08-15T21:07:01.862Z