Single-flight credential fetch: slow-controller and expiry-margin edge cases #34

Follow-up to the single-flight credential fetch in agentdesktop-dev#134 (part of agentdesktop-dev#86). No extra controller calls; latency only.

Problem

1. Failed fetches are not cached. With a hung or failing controller, the requests of a burst fetch one after another under the key's flight lock. Each request still fails after its own 20 s wait, but the detached fetches stay queued and drain at up to 15 s each.
2. The flight lock is held across refresh_oauth_if_needed, whose reqwest client (oidc.rs) has no timeout. Refreshes were already serialized by OAUTH_REFRESH_MUTEX before.
3. A credential issued with less than the 30 s expiry margin left is never cached, so each request waiting behind it fetches again (3 waiters, 3 fetches).

Expected

Share a failed result with the waiters of the same fetch (a short negative cache), bound the OAuth refresh client, and hand a just-fetched credential to the current waiters even when it is inside the margin.

🤖 Generated with Claude Code