v3.2.3 - fix: 429 quota resilience, token refresh isolation, and concurrency safety

What's Fixed

Account-Scoped 429 RESOURCE_EXHAUSTED Recovery

• When an individual account exhausts its quota (returning 429 RESOURCE_EXHAUSTED on Claude or Gemini), the proxy now safely releases the failed account before rotating, allowing immediate retry with the next eligible account in the pool instead of failing prematurely (#23 by @javargasm).

Synchronous Account Leasing & Atomic Concurrency Accounting

• inFlightRequests reservation and model assignment tracking now occur synchronously and indivisibly at lease time before asynchronous save or refresh operations. If activation fails, in-flight counters are rolled back and token buckets are refunded immediately (#23 by @javargasm).

Snapshot-Based Token Refresh & Generation Tracking

• Provider token refreshes execute against isolated account snapshot clones. Refreshed tokens are published only if the credential generation has not changed during flight, cleanly discarding stale tokens if credentials were reconfigured (#23 by @javargasm).

Provider-Scoped Token Publication

• Token refreshes for multi-provider accounts (e.g. Google Antigravity + OpenAI Codex) now update strictly provider-owned fields, preventing cross-provider token and credential overwrites (#23 by @javargasm).

Identity Resolution with Non-Secret Credential Fingerprinting

• Duplicate-email accounts without stable provider IDs are resolved using a 12-character SHA-256 non-secret credential fingerprint, isolating runtime state during replaceConfig (#23 by @javargasm).

Exact Incarnation Exclusion on Retry

• rotateToNext(model, failedAccount) binds exclusion strictly to the exact runtime object instance, preventing false 503 errors when an account is replaced by a healthy incarnation (#23 by @javargasm).