feat: add global auth-failure circuit breaker to coordinate polling on 401

[birme]

Closes #597

Summary

• Add a new framework-agnostic singleton src/api/auth-circuit-breaker.ts implementing a three-state machine (closed → reauthing → closed on success / open on failure).
• Route every 401 through handle-fetch-request.ts, a single chokepoint that reports to the breaker: the first 401 trips it to reauthing while concurrent 401s are deduplicated so exactly one coordinated reauth runs.
• Add use-reauth.tsx, a hook mounted in App.tsx, to configure the breaker with the reauth runner and error handling.
• Make polling hooks respect the breaker — use-line-polling.ts, use-heartbeat.ts, use-fetch-production-list.ts, and use-websocket-reconnect.ts pause while reauthing, resume with reset failure counters on success, and stop when the breaker trips open.

Test plan

• Tests pass (npm test in both repos)
• TypeScript compiles (npm run typecheck)
• Lint clean (npm run lint)
• New auth-circuit-breaker.test.ts covers the 10 state-machine cases
• Updated heartbeat and production-list hook tests pass; full suite reports 304 tests passing

🤖 Generated with Claude Code

[birme]

code-reviewer verdict: NEEDS CHANGES (automated self-review; recorded as a marker because GitHub blocks state-bearing self-review when author and reviewer are the same account).

Blocking

• The circuit breaker's open state is terminal (only reset() on unmount exits it) and, for suppressed statuses (500/404/405), silent. A transient 500 (expected when the initial OSC token expires) or a stray pre-config 401 now permanently stops all app-wide polling — including the active-call use-heartbeat — with no error surfaced. When heartbeats stop mid-call the manager reclaims the SMB session, silently killing a live call. This is a resilience/UX regression from the previous self-healing per-hook logic. Needs a half-open/backoff retry, or keep polling alive for suppressed/transient cases, or at minimum surface a visible "connection lost" state when the breaker goes terminally open.

Warnings

• A 401 that resolves before configure() commits trips the breaker open with a swallowed error (no runner/errorReporter yet). Add a defensive guard/queue.
• No test coverage for the new gate() logic in use-line-polling or the use-websocket-reconnect breaker integration; the use-fetch-production-list tests only assert reauth isn't called, not that fetches pause/resume with breaker state.

Suggestions

• Guard the failure branch with if (state === "reauthing") like the success branch, so a post-reset() failing reauth can't re-open the breaker.
• Note in use-heartbeat that the breaker is now the primary 401 coordinator (its own failure401Count path now overlaps).

The core dedup guarantee (exactly one coordinated reauth under concurrent 401s) is correct, there's no import cycle, and subscription cleanup is sound — the issue is specifically the terminal/silent open state.

[birme]

code-reviewer verdict: LGTM (automated self-review; recorded as a marker because GitHub blocks state-bearing self-review when author and reviewer are the same account).

The prior blocking defect — the circuit breaker's open state being terminal and silent, which could permanently stop all polling (including the active-call heartbeat) on a transient 500 / stray 401 — is genuinely fixed and verified: open is non-terminal (half-open retry on 2s→30s exponential backoff, cycling back to closed on the first successful reauth), the failure is now surfaced via a visible auto-dismissing WARNING that onRecover clears, the heartbeat/line-polling hooks resume on open, a pre-configure() 401 is queued and replayed, and the concurrent-401 dedup guarantee still holds with no import cycle and sound timer/subscription cleanup. typecheck, lint and the full suite (39 files / 319 tests, incl. ~12 new breaker/gate tests) pass.

Non-blocking follow-ups for later (not gating merge): persistent 404/405 reauth-impossible backends keep polling paused (consider treating definitive 404/405 as resume-and-stay-closed); add a DEV guard mirroring useSetupTokenRefresh; dispatch the warning once per closed→open edge rather than every retry; have onRecover also clear a non-suppressed ERROR banner.