fix(oauth): revoke replaced sessions and preserve token metadata

[EhabY]

Summary

Follow-up to #1138's token-cleanup comment: clean up replaced OAuth sessions without forcing an immediate re-login when required scopes change. Closes #1140: this PR covers items 1 and 3, and #1128 covers item 2.

• Keep existing expiry behavior: missing required scopes stop refresh but keep the stored access token, so normal 401 recovery applies after expiry. The eligibility check is renamed to canRefreshOAuthSession.
• Revoke replaced sessions: a successful sign-in saves first, then revokes the overwritten OAuth pair in the background (best effort) with the client registration read before login. Failed or canceled sign-ins, same-token reuse, and stored-session adoption revoke nothing.
• Preserve OAuth metadata on reuse: reusing the same token on the same origin keeps its refresh credentials and scopes. If a refresh rotates the session while its stored token is checked, the rotated session wins.
• Share OAuth plumbing: revokeOAuthTokens in src/oauth/revocation.ts serves logout and replacement. withOAuthMetadata in src/oauth/metadataClient.ts creates the client and fetches metadata for revocation and token refresh.
• Scopes: request user:update_personal to refresh expired workspace external-auth links. Inbox permissions stay optional.
• Dynamic client registration disabled (OAuth follow-ups: DCR off by default on 2.38, unnoticed nightly scope failures, CLI inheriting CODER_SESSION_TOKEN #1140, item 1): when registration returns 403 (the default from Coder 2.38), a modal names dynamic_client_registration_enabled and offers Sign In with Token. Dismissing it cancels sign-in, so nothing switches methods silently.
• CLI token from the environment (OAuth follow-ups: DCR off by default on 2.38, unnoticed nightly scope failures, CLI inheriting CODER_SESSION_TOKEN #1140, item 3): the shared global flags (getGlobalFlags and getGlobalShellFlags) now start with an empty --token=. The CLI applies flags over environment variables, so CODER_SESSION_TOKEN in the extension host no longer overrides the stored session. That holds for any case variant and for HOMEBREW_CODER_SESSION_TOKEN. Every invocation is covered, including the SSH ProxyCommand and terminals. A user's own --token in coder.globalFlags comes later and still wins. coder login --use-token-as-session omits the flag because it reads the token from the environment. It gets an environment with any host case variants of CODER_SESSION_TOKEN removed, so only the extension's token remains. This behavior was checked in the Coder source from v0.25.0 (the minimum supported version) through main.

Out of scope: startup or remote admission gates, per-action permission maps, and a background-refresh redesign. Before expiry, users can still see feature-specific permission errors; those don't prompt for sign-in.

Change size

Diff against the merge base; counts include moved code and renames.

Area	Added	Removed	Net
Production (src/**)	260	149	+111
Tests (test/**)	266	34	+232
Changelog	12	3	+9
Total	538	186	+352

Validation

Single commit on top of #1134.

• pnpm test: 189 files, 2,830 passed, 6 skipped.
• pnpm typecheck, pnpm lint, and pnpm format:check: passed.
• Integration tests were not rerun for this revision.
• Regression tests cover stored and provided token reuse; manual, provided, and OAuth replacement; refresh rotation during a stored-token login; save-before-revoke ordering; failed and canceled sign-in; the registration 403 path (accept and dismiss); the empty --token= flag in every CLI invocation, a user --token overriding it, storeToken omitting it, and storeToken dropping a host coder_session_token.

Known limitations

• A background refresh already in flight when an OAuth sign-in replaces the session can race the revocation. Fixing that needs refresh coordination, which is out of scope here.
• If another window re-registers the client mid-login, revoking the old session can fail. The failure is logged at warn level.

Generated by Coder Agents on behalf of @EhabY.