remote/oidc: silent refresh + one-shot 401 retry on the attach path (T7)

[platypii]

Chunk 5 of the OIDC client login (LLP 0046-0048), milestone 3. Stacked on #200 (base chunk4-login-command); review/merge after #197-#200.

What (LLP 0046 D5)

• remote_verb.js resolves the bearer via resolveAccessJwt (not resolveToken), passing the origin-derived identity base; a stale cached JWT is refreshed + persisted before the call.
• client.js tags 401/403 rejections (authError, status). On a live auth error for an oidc/file session, the attach path forces one refresh and retries once; an env override / static token is surfaced as-is.
• A refresh that fails invalid_grant surfaces remote session expired - re-run 'hyp remote login <target>'.
• resolveAccessJwt gains forceRefresh; deriveIdentityBase relocated to credentials.js as the single shared D6 definition (login command + attach path both import it).

Tests

remote-verb-oidc.test.js (4): stale-refresh-before-call, exactly-one mid-flight refresh+retry, invalid_grant -> re-login, static-not-retried. Full npm test green (1527 pass); typecheck clean.

🤖 Generated with Claude Code

[platypii]

Review (independent agent review)

Verdict: request-changes → addressed. The silent-refresh and one-shot 401 retry are well-structured: retry is exactly once (no loop), isAuthError keys on the authError/status tag from client.js, refreshability is correctly gated to kind === 'oidc' && source === 'file' (env/static surfaced as-is), a tool-level isError is a normal return (never retried), and deriveIdentityBase has a single definition with no layering inversion.

Finding (major)

• The initialresolveAccessJwt was not wrapped in try/catch. When an oidc target's stored JWT is already stale, the initial resolve does a pre-call refresh; if the refresh row is revoked that throws InvalidGrantError, which escaped runRemoteVerb (and verb_command.js) as an unhandled rejection instead of D5's clean re-login guidance — the canonical "you're logged out" case. The existing invalid_grant test used expiresAt: FUTURE, so it only exercised the mid-flight 401 path and missed this.

Addressed in this PR

• The initial resolve is now wrapped and mapped exactly like the retry path, via a shared mapRefreshError(err, target) helper (invalid_grant → re-login + exit 2; other → generic + exit 1).
• Added a unit test with expiresAt: PAST + a revoked refresh asserting exit 2 and the re-login message.

(This fix was originally delivered in the T8 follow-up; it has been relocated here so #201 is correct standalone.) 11 tests green, typecheck clean.