Persist refused refresh-token suppression

[robzolkos]

What changed

• replace a refused credential with a signed-out record when the keyring permits writes but refuses deletion
• stop a later command or process from submitting the same rejected refresh token
• clear cached mail when the refused credential is replaced
• let a later successful login overwrite the signed-out record normally

Validation

• make test
• make lint

This is stacked on #464 so each authentication change can be reviewed separately.

Basecamp card

---

Summary by cubic

Persists suppression of a refused refresh token across processes when the keyring won't delete the dead credential. Previously a failed delete left the token on disk, so another command or process loaded and re-sent it. Now the refused credential is replaced with a signed-out record, and a later successful login overwrites that record normally. Replacing the credential also clears cached mail so it doesn't outlive the credential that fetched it.

• Refresh now recognizes signed-out records and returns a login-required error instead of trying to refresh them.

^{Written for commit c5323cb. Summary will update on new commits.}

[cursor]

Stale comment

Approved. Cursor Bugbot and Cursor Security Agent were not present after the first check poll, so those signals were skipped and remaining review state did not require human review. No reviewers were assigned.

  

_{Sent by Cursor Approval Agent: Pull Request Approver}

[Copilot]

Copilot review overview

🟡 Changes recommended

Existing managers can classify the new signed-out tombstone as a generic retryable error, and callback documentation is outdated.

Get a fresh assessment by requesting another Copilot review.

Review effort: Balanced
Findings: 1 · 1

Open (2)

• Classify cached tombstone as authentication error · New
• Document callback invocation when replacing credentials with signed-out state · New

What changed in this PR

Persists signed-out state when rejected refresh credentials cannot be deleted.

Changes:

• Replaces refused credentials with an empty record.
• Clears cached mail after replacement.
• Tests cross-manager suppression and subsequent login.

[!TIP]
If you aren't ready for review, convert to a draft PR.
Click "Convert to draft" or run gh pr ready --undo.
Click "Ready for review" or run gh pr ready to reengage.

File	Description
internal/​auth/​auth.go	Adds durable refused-token suppression.
internal/​auth/​auth_test.go	Tests replacement, cache clearing, and login recovery.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟢 Approved

The implementation and regression tests consistently handle deletion failure, cross-process suppression, and successful relogin.

Review effort: Balanced
Findings: None

Resolved since last review (2)

• Classify cached tombstone as authentication error
• Document callback invocation when replacing credentials with signed-out state

Dismissed the prior approval because Cursor Security Agent was present but still not terminal after the 8-minute wait. Human review is needed; no reviewers were assigned.