fix: coalesce concurrent automatic OAuth refreshes

[ch-z-hc]

Problem

Concurrent SDK calls using expired OAuth credentials each call ensureFreshToken() independently. They can submit the same refresh token multiple times before any caller saves the replacement. With refresh-token rotation, callers can fail authentication even though another request successfully refreshed the session.

The regression uses two public MiniMaxSDK instances and four concurrent speech/image calls against a loopback fixture that accepts a refresh token once. On unchanged main, only one call succeeds; after this patch, all four succeed with one refresh request. This models token rotation locally, not a claim of live MiniMax service verification.

Change

• Share the pending automatic refresh, including credential persistence, by configuration path, region and refresh token. Clear it after success or failure; do not cache completed results.
• Resolve and retain the configuration path through saving so an environment change cannot write another store's credentials. Reuse the existing config parsing and atomic-write helpers.
• Cover successful SDK calls, refresh/save failures and subsequent attempts, distinct regions/tokens/stores, and absolute/relative paths selecting the same store. Preserve account metadata and unrelated configuration.

Related to the refresh race described in #79, but deliberately limited to automatic refreshes within one process. It does not fix races between separate CLI processes or coordinate the manual auth refresh command. Existing request/retry behavior is unchanged.

Verification

• Seven new regression/control cases; five fail against unchanged main.
• Focused auth, config, HTTP and SDK tests: 106 passed.
• Windows and Linux typecheck, lint and production CLI/SDK/declaration builds pass. Lint retains the existing explicit-any warning in test/sdk/speech.test.ts.
• Full Linux suite with identical added tests: original 598 passed / 8 failed; patched 603 passed / 3 failed. Both still fail the same two unreachable-region timeout tests and the FileSDK upload base-URL assertion. Those failures were not changed or diagnosed here; the full suite is not green.

Full runs use temporary configuration, a validation-only preload rejecting external fetches by default (test mocks can replace fetch), and a process-local no-op URL opener. No live model requests or real credentials were used.

Developed with OpenAI Codex assistance, including local reproduction, regression tests and independent automated blind reviews. This is not human review or live-service validation.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}