fix: detect and recover from stale OAuth credentials in background workers

[BYK]

Problem

Background workers (distillation, curation, cache warming) use cached OAuth Bearer tokens from resolveAuth() in auth.ts. When tokens expire between client requests, all background work fails silently with 401 errors — no Sentry alert, no retry, no credential refresh.

Root cause: TRANSIENT_CODES in llm-adapter.ts does not include 401, so the worker returns null immediately with no retry. The credential remains cached and every subsequent worker call repeats the 401 silently.

Changes

auth.ts — Per-session staleness tracking

• Add staleSessionAuth Set with markAuthStale() / isAuthStale() / clearAuthStale()
• resolveAuth() skips stale session credentials, falling through to the global lastSeenAuth fallback (which may have been refreshed by a concurrent client request)
• setSessionAuth() auto-clears staleness when a fresh credential arrives

llm-adapter.ts — 401/403 detection, re-resolve + retry, Sentry alert

• Add AUTH_ERROR_CODES set (401, 403) — checked before the generic non-transient error path
• On auth error: mark credential stale → re-resolve → if credential changed, rebuild request and retry once → if still failing, Sentry.captureException() with fingerprint ["LOREAI-GATEWAY", "worker-auth-error", status]
• attempt === 0 guard prevents infinite retry loops
• Response body included in retry log for diagnostics

cache-warmer.ts — Auth-disabled sessions

• Add authDisabledSessions Set with isWarmupAuthDisabled() / clearWarmupAuthDisabled()
• On 401/403 in executeWarmup(): add session to disabled set + call markAuthStale() — prevents unbounded 401 spam on every 30s idle tick
• _resetForTest() clears the new state

idle.ts — Skip auth-disabled sessions

• Add isWarmupAuthDisabled(sessionID) early-exit check in the warmup loop, before expensive profile/histogram/survival computation

pipeline.ts — Clear auth-disabled state on fresh credentials

• Call clearWarmupAuthDisabled(sessionID) when setSessionAuth() binds a fresh credential from a client request

Design Decisions

1. Staleness tracked via separate Set (not on AuthCredential type) — follows batch-queue.ts's disabledBatchSessions pattern, keeps the AuthCredential union clean
2. Re-resolve, not refresh — the gateway does not implement OAuth token refresh; it passively captures credentials from client requests. The re-resolve picks up tokens that were refreshed by a concurrent client request.
3. At most one retry — guarded by attempt === 0 and freshCred.value !== cred.value; if both session and global credentials are expired, bails immediately
4. Not persisted — staleness and auth-disabled state are process-lifetime only; on restart, the first client request provides fresh credentials

What This Does NOT Change

• LLMClient interface in @loreai/core — return type stays string | null
• batch-queue.ts — already handles 401/403 correctly
• API-key auth — API keys don't expire, so 401 is never triggered for them

Tests

• New test/auth.test.ts: 12 tests for staleness tracking and resolveAuth behavior
• test/llm-adapter.test.ts: 4 new tests for AUTH_ERROR_CODES
• test/cache-warmer.test.ts: 4 new tests for warmup auth-disabled sessions
• test/helpers/idle-worker.ts: updated mock to include isWarmupAuthDisabled

Closes #453