pendingRefreshes deduplication doesn't protect against cross-worker races

[mystixxx]

The pendingRefreshes Map added in #384 deduplicates concurrent. WorkOS refresh attempts within a single PM2 worker, but not across workers.
Two requests hitting different workers with the same expired token will still both call refreshWorkOSSession() and race.

Currently mitigated by BATCH_SIZE=1 on the frontend. A proper fix would require a Redis-based lock (SET NX EX) since Redis is already in the stack.