feat(auth): harden X.509 token lifecycle and tenant isolation (#2473)

## Summary

Part 4 of 5; based on `codex/x509-03-client-integration`.

- Add tenant/account/certificate-scoped, generation-safe token caching,
singleflight refresh, clone sharing, proactive refresh, and bounded 401
rotation.
- Classify issuer/API transport failures privately: retry or temporarily
reuse a still-valid bearer only for approved transient failures;
permanent TLS, protocol, OAuth, and tenant failures are terminal.
- Enforce exact tenant-header snapshots, reject underscore aliases,
cancel abandoned refreshes/backoff, sanitize nested transport/body
errors, and apply one monotonic deadline to successful and failing
responses.

## Verification

- 243 focused lifecycle/security/transport/client regressions, including
stale same-byte generations, repeated 401s, noncooperative abandoned
refreshes, TLS trust failures, tenant aliases, and hung response bodies.
- Exact minimum Node 22.22.0, `pnpm lint`, `pnpm exec tsc --noEmit`,
`pnpm build`, and packed npm artifact checks.
- Two independent security-review rounds and a completed full-stack
Codex Security diff scan: zero remaining findings.

Next: `codex/x509-05-e2e-docs-hardening`.