v0.5.3 — Refresh tokens and coordinate OAuth sign-ins

This release refreshes expired OAuth tokens and shares authorization across concurrent proxy processes, reducing repeated browser sign-ins.

After upgrading, sign in once again. Credentials are stored by proxy version, so this release uses a new token directory. Node.js 18 or newer is required.

• Refresh expired tokens and save rotated credentials atomically. Temporary refresh failures preserve saved credentials instead of immediately opening a browser.
• Coordinate sign-in and rejected-token recovery across processes, so concurrent clients reuse the resulting credentials.
• Validate authorization-server metadata, bind credentials to their issuer, and handle MCP authentication challenges and scope upgrades.
• Validate callback state, issuer, and origin, and report callback errors promptly.

Changes: #143 and #144 by @galatanovidiu.

Full comparison: v0.5.2...v0.5.3