fix(auth): preserve desktop sessions across refresh and restart

[rohitsabu]

Fixes three session-persistence defects with behavior-first regression coverage:

• restore encrypted Desktop native tokens with their persisted camelCase schema instead of the gateway wire parser
• retain the previous refresh token when a provider omits a replacement
• deduplicate stale parallel cookie refreshes for a bounded 15-second replay grace so rotating refresh-token reuse detection cannot turn a healthy refresh into a 401 cookie clear

Red evidence:

• native persisted-token/refresh tests: 4 failures before the fix
• stale parallel cookie requests: first request 200, second request 401 before the fix

Verification after rebasing onto current main:

• Desktop typecheck passed
• Electron platform suite: 798 passed, 2 skipped
• dashboard-auth suite: 293 passed
• Ruff and git diff checks passed

The replay cache is process-local, capped at 256 entries, keyed by a SHA-256 token digest plus client address and provider identity, and never logs or persists credential material.

[teknium1]

Thanks for isolating the persisted-token schema and omitted-refresh-token cases; both premises are present on current main (apps/desktop/electron/main.ts:6187,6222,6287).

Problems

• The replay cache does not deduplicate actual overlap. hermes_cli/dashboard_auth/middleware.py:673 checks the cache, but :677 performs _attempt_refresh after that lock has been released and :683 only records the result afterward. Two requests can both miss and consume the same rotating token.
• The new test is sequential: tests/hermes_cli/test_dashboard_auth_401_reauth.py:295 completes first.get() before :296 starts the second request, so it cannot exercise that race.
• The same single-use-token exposure remains in native desktop refresh: apps/desktop/electron/main.ts:6262-6288 has multiple callers and no in-flight coordinator; /auth/native/refresh documents reuse as a 401 condition in hermes_cli/dashboard_auth/routes.py:894-907.

Suggested changes

• Use keyed single-flight coordination around the dashboard refresh and add a genuinely overlapping regression test.
• Coalesce native ensureNativeAccessToken refreshes per base URL, or scope the change's claims accordingly.

Automated hermes-sweeper review.

[teknium1]

This call occurs after the cache-miss lock has been released, so two overlapping requests can both reach the provider before either reaches _remember_recent_refresh. Please use keyed single-flight coordination and re-check the completed result for waiters; the current test's sequential requests do not cover this interleaving.