[Bounty $35] Coordinate concurrent token refreshes across tabs

[ahdaolma]

Summary

Closes #1. Add single-flight token refresh coordination and cross-tab lifecycle propagation without logging or persisting raw tokens in notification payloads.

Changes

• Share one in-flight refresh promise per tab and clear the marker after both success and failure.
• Propagate success/failure through BroadcastChannel, with a storage-event metadata fallback.
• Reload successful tokens from the existing token store in other tabs and avoid cross-tab overwrites during a local refresh.
• Add npm run validate:auth-refresh, a deterministic invariant check for the race and cleanup paths.

Testing

• npm run validate:auth-refresh ✅ (8 invariants)
• npm run build ✅
• python3 build.py ⚠️ the repository's launcher is unavailable on this Windows host. The bundled Python runtime was also tried with UTF-8 output; its prerequisite scan reached the encryptly diagnostic preflight but did not finish within the available run window, so no new diagnostic artifact was generated.

No raw access or refresh tokens are written to the cross-tab event record or logs.