fix(client): dedupe concurrent OAuth refreshes

[raashish1601]

Summary

• dedupe in-flight refreshes per provider, authorization server, resource, and refresh token inside auth()
• reuse the shared refresh result so parallel callers do not replay rotating refresh tokens
• add a focused auth regression and a patch changeset for @modelcontextprotocol/client

Fixes #1760.

Validation

• corepack pnpm test -- --run test/client/auth.test.ts
• corepack pnpm exec tsgo -p tsconfig.json --noEmit
• corepack pnpm exec eslint --config eslint.config.mjs src/
• corepack pnpm exec prettier --ignore-path ../../.prettierignore --check src/client/auth.ts test/client/auth.test.ts

[changeset-bot]

🦋 Changeset detected

Latest commit: a059ef1

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
@modelcontextprotocol/client	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/client@1800

@modelcontextprotocol/server

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/server@1800

@modelcontextprotocol/express

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/express@1800

@modelcontextprotocol/hono

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/hono@1800

@modelcontextprotocol/node

npm i https://pkg.pr.new/modelcontextprotocol/typescript-sdk/@modelcontextprotocol/node@1800

commit: a059ef1