fix(attention): cover stale refresh ordering and sign-in fixture

[Dumbris]

Remaining low-severity findings from PR #1382 (Spec 109-d):

• Order overlapping macOS attention refreshes (glm:final-3.1): Two refreshAttention() requests for the same connection can complete out of order and briefly restore stale rows until the next SSE event or 30-second poll. Ignore stale responses or otherwise preserve request ordering.
• Make the sign-in attention test derive its row from the fixture (glm:final-4.1): AppStateOAuthSignInTests.testLoginRequiredServerStillNeedsAttention stores a hard-coded sign_in_required row, so changing the loginRequiredServer() fixture does not exercise the fixture-to-attention mapping.

Both findings were verified against the merged code. No critical, high, or medium findings remain.