fix(oauth): honor connectionId on token refresh so email-less providers don't duplicate

[insoln]

Fixes #8059

Problem

Pressing Refresh token on a GitHub Copilot connection creates a second connection instead of updating the existing one.

Root cause

persistOAuthConnection (src/lib/oauth/connectionPersistence.ts) gates its entire dedup step behind if (tokenData.email). The matcher it calls (findExistingOAuthConnectionMatch) already matches by explicit connectionId first, but it's never reached when the payload has no top-level email. GitHub Copilot's device-code flow keeps identity under providerSpecificData.githubEmail, so tokenData.email is undefined — the refresh (which does pass the existing connectionId) skips the whole match and falls through to createProviderConnection, producing a duplicate.

Fix

Two small changes in connectionPersistence.ts:

1. Widen the gate to if (connectionId || tokenData.email) — an explicit connectionId (refresh / re-auth of a known connection) is honored regardless of whether the payload carries a top-level email.
2. In findExistingOAuthConnectionMatch, guard the email branch with if (!tokenData.email) return false; — without it safeEqual(undefined, undefined) is true, so once the gate is widened an email-less payload could false-match another email-less connection. Email dedup now requires a non-empty email.

The connectionId-first and email/Codex-workspace matching semantics are otherwise unchanged.

Testing

New tests/unit/oauth-refresh-connection-dedup-8059.test.ts (4 cases, real SQLite):

• A Copilot-style refresh (no top-level email) with the existing connectionId updates the connection — one connection, token updated. Verified red on the unfixed gate (asserts the duplicate) and green after the fix.
• findExistingOAuthConnectionMatch: connectionId wins without an email; an email-less payload does not false-match an email-less connection; email dedup still works when an email is present.
• npm run typecheck:core and ESLint clean.

Note: this is preventive — a duplicate created before the fix must still be removed manually.

[gemini-code-assist]

Caution

The consumer version of Gemini Code Assist on GitHub has been sunset. All code review activity has officially ceased.

[diegosouzapw]

Obrigado, @insoln — mergeado na release/v3.8.49. Validado no tip combinado (merge-train: typecheck + file-size + 106 testes das áreas tocadas + vitest 271/271 verdes). O único red de CI era o base-red compartilhado de complexity (pré-existente na tip da release, não deste PR).