fix(connect): token refresh lifecycle, backoff and error-taxonomy follow-ups

[g-despot]

Why

Split out of #2056 (the Pyodide/WASM PR). Fixes for the OIDC token refresher. They affect every platform, so they get their own review. #2142 (the trimmed WASM PR) is based on this branch.

What changes

• close() now stops the background token refresher. Before, the stop flag was never set, so the refresh thread kept running after close().
• The sync refresh thread waits on that flag instead of sleeping, so close() ends it right away instead of up to expires_in − 30 s later.
• Each refresher keeps its own stop flag. Before, after close() + connect() the old thread picked up the new flag and two threads were refreshing at once.
• The async client refreshes tokens in an asyncio task instead of a thread plus an event-loop helper thread; close() cancels it and waits for it. (Also needed for Pyodide, where threads can't start.)
• Any refresh error is caught and retried after 1 s. Before, only httpx.HTTPError was caught, so e.g. an authlib invalid_grant error silently killed the refresh thread.
• The first refresh runs 30 s before the token expires, like every later one. Before, it ran exactly at expiry.
• The sync refresh loop uses one client object per round, so a refresh that is still running when close() or connect() replaces the client finishes against the client it started with.

Warnings and error messages are unchanged.

Tests (mock_tests/test_auth.py, 5 new)

• async client-credentials refresh works on the task
• a failing refresh keeps the refresher alive and retrying (sync and async)
• the async client starts no threads, and its task is done after close()
• sync: close() ends the thread right away, and a reconnect leaves exactly one thread

[orca-security-eu]

Orca Security Scan Summary

Status	Check	Issues by priority
Passed	Infrastructure as Code	0   0   0   0	View in Orca
Passed	SAST	0   0   0   0	View in Orca
Passed	Secrets	0   0   0   0	View in Orca
Passed	Vulnerabilities	0   0   0   0	View in Orca

[codecov-commenter]

Codecov Report

❌ Patch coverage is 96.85039% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.67%. Comparing base (95b5d76) to head (0abdd6a).
⚠️ Report is 79 commits behind head on main.

Files with missing lines	Patch %	Lines
weaviate/connect/v4.py	91.48%	4 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2140      +/-   ##
==========================================
+ Coverage   86.64%   88.67%   +2.02%     
==========================================
  Files         300      303       +3     
  Lines       23172    23489     +317     
==========================================
+ Hits        20077    20828     +751     
+ Misses       3095     2661     -434     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Improves OIDC token refresher lifecycle management for synchronous and asynchronous clients.

Changes:

• Adds cancellable async token-refresh tasks.
• Signals sync refresh threads during shutdown and retries broader refresh failures.
• Adds lifecycle, retry, and reconnect tests.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
weaviate/connect/v4.py	Revises token refresh and shutdown handling.
mock_tests/test_auth.py	Adds refresh lifecycle and failure tests.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.