fix: update all CLI tokens on PAT rotation (stale token after reattach)

[datasciencemonkey]

Problem

When reattaching to a session from a previous day, Claude Code shows 403 Invalid access token because PAT rotation updates ~/.databrickscfg and DATABRICKS_TOKEN env var but NOT the CLI config files.

All coding agent CLIs store the token as a literal value:

• Claude: ~/.claude/settings.json → env.ANTHROPIC_AUTH_TOKEN
• Codex: ~/.codex/.env → OPENAI_API_KEY=
• OpenCode: ~/.local/share/opencode/auth.json → databricks.api_key
• Gemini: ~/.gemini/.env → GEMINI_API_KEY=

These are only written once via _configure_all_cli_auth() in /api/configure-pat. After 10-min rotation, the literal values are stale.

Fix

Add _update_cli_tokens(token) that swaps the literal token in each config file. Call it from pat_rotator._persist_token() on every rotation.

Related

• PR feat: zero-config auth — interactive PAT setup, auto-rotation, all CLIs (#81, #83) #82 — PAT auto-rotation implementation
• PR feat: session detach & reconnect — tabs detach, only exit kills #84 — Session detach & reconnect (exposed the bug — reattaching to old sessions)