Token refresh is now serialised across concurrent server processes: a refresh spends the newest refresh token on disk, adopts a pair another process stored
instead of rotating again, and only clears credentials when the token that failed is still the one on disk — so a lost race no longer logs every session out.