8ae82573ab
Prevent concurrent refresh-token rotation across instances, distinguish expired-but-refreshable tokens from active authorization, and bind OAuth popup polling to a per-attempt ID so stale tokens cannot satisfy new consent.