fix(client): deduplicate concurrent OAuth refreshes

[CharlesMcMillan]

Concurrent 401 handlers that share one OAuth provider now share one in-flight auth flow. This prevents parallel requests from redeeming the same rotating refresh token and invalidating the session.

Authorization-code exchanges and forced reauthorization bypass deduplication because they carry one-time flow state. Different providers still refresh independently.

Fixes #1760.
Supersedes #1813.

Tests

• pnpm --filter @modelcontextprotocol/client test — 883 passed
• pnpm --filter @modelcontextprotocol/client check
• Pre-push build:all, typecheck:all, and lint:all
• Dogfooded the packed client through Pi's installed dependency tree: 3 concurrent refreshes produced 1 token request, and an authorization-code exchange remained independent

[changeset-bot]

🦋 Changeset detected

Latest commit: a8335db

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 6 packages

Name	Type
@modelcontextprotocol/client	Patch
@modelcontextprotocol/codemod	Patch
@modelcontextprotocol/core	Patch
@modelcontextprotocol/server-legacy	Patch
@modelcontextprotocol/server	Patch
@modelcontextprotocol/core-internal	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[CharlesMcMillan]

@claude review

[pkg-pr-new]

Open in StackBlitz

@modelcontextprotocol/client

npm i https://pkg.pr.new/@modelcontextprotocol/client@2757

@modelcontextprotocol/codemod

npm i https://pkg.pr.new/@modelcontextprotocol/codemod@2757

@modelcontextprotocol/core

npm i https://pkg.pr.new/@modelcontextprotocol/core@2757

@modelcontextprotocol/server

npm i https://pkg.pr.new/@modelcontextprotocol/server@2757

@modelcontextprotocol/server-legacy

npm i https://pkg.pr.new/@modelcontextprotocol/server-legacy@2757

@modelcontextprotocol/express

npm i https://pkg.pr.new/@modelcontextprotocol/express@2757

@modelcontextprotocol/fastify

npm i https://pkg.pr.new/@modelcontextprotocol/fastify@2757

@modelcontextprotocol/hono

npm i https://pkg.pr.new/@modelcontextprotocol/hono@2757

@modelcontextprotocol/node

npm i https://pkg.pr.new/@modelcontextprotocol/node@2757

commit: a8335db