v2.1.2

• Internal refactor: VaultBaseAuth no longer overloads a single __authToken field with two
  types. The in-flight login now lives in __pendingLogin (Promise<AuthToken>|null) and the
  resolved token in __authToken (AuthToken|null), so getAuthToken() reads the auth state
  directly instead of discriminating with instanceof at each use site. No behavior change —
  the single-flight login (concurrent callers share one login) and the renewal-timer wiring are
  unchanged, and both are now pinned by tests. Closes #120.