v0.2.3

Fix: intermittent "unexpected server error" on token expiry

Keycloak rotates refresh tokens (each is redeemable only once). Under
concurrent requests near expiry, every loader invocation POSTed the same
stored refresh token — the first rotated it, the rest got invalid_grant and
forced a spurious opencode auth login. The loader now shares a single
in-flight refresh across concurrent calls, so the rotating token is redeemed
exactly once and both callers get the new access token.

• src/loader.ts: single-flight refresh (cleared on settle → next expiry retries cleanly).
• test/loader.test.ts: +5 tests (single-flight, past-expiry, leeway boundary, rotation reuse, retry-after-failure).

Prebuilt plugin — no build needed

Two assets are attached, both produced by npm ci && npm run build in CI:

• opencode-keycloak-auth.js — self-contained ESM bundle (zero runtime deps). Drop it straight into OpenCode's auto-load dir:

  mkdir -p ~/.config/opencode/plugins
  curl -fsSL -o ~/.config/opencode/plugins/keycloak.js \
    https://github.com/AyRickk/opencode-keycloak-auth/releases/latest/download/opencode-keycloak-auth.js
  # configure via OPENCODE_KC_ISSUER / OPENCODE_KC_CLIENT_ID / ... env vars

• opencode-keycloak-auth-0.2.3.tgz — vendored tarball for npm install ./*.tgz.

Full Changelog: v0.2.2...v0.2.3