renderer: token bootstrap is single-flight only while in flight, the dev-token route never re-enters the interceptor, and a transport failure consults the live port at once

[kai-openswarm]

Draft, stacked on #147 and #142 (both touch shared/config.ts; the branch merges #142 into #147's tip so the diff shows only this change once those two merge). Renderer hardening in the auth/fetch layer every request goes through; no product behaviour changes.

Four small changes to shared/config.ts:

	Change	Why
Single-flight, in flight only	ensureAuthToken() shares its promise only while a refresh is in flight; once settled the slot clears and the cache is the source of truth (a non-empty cache short-circuits).	The resolved-forever memo it replaces either poisoned retries (an empty result) or shadowed a later forced refreshAuthToken() failure — the WebSocket 4401 path — with the stale token. The boot race (ENG-207) stays covered: an empty resolve is never memoized because the slot clears on settle.
Non-OK clears the cache	refreshAuthToken() treats a non-OK dev-token response like a thrown transport error.	A forced refresh that gets a 500 no longer returns the token it was asked to doubt.
The dev-token route bypasses the interceptor	/api/dev/token goes out as raw transport (no bearer, no dedupe) and is awaited, so a rejection lands in the catch below.	Without it, refreshAuthToken's own fetch re-enters the interceptor before _authTokenPromise is assigned (an async fn suspends only at its first await), ensureAuthToken starts another refresh, and the renderer recurses synchronously until RangeError whenever there is no preload bridge — Electron always has one; a plain browser tab on run.sh does not.
Heal at the first failure	A GET transport failure consults the live backend port on the first failed attempt (one-shot, reloads only if the port differs); a TypeError reaching the outer catch does the same.	Instead of retrying against a dead port for seconds first.

Tests: shared/config.test.ts under node:test — one module instance over a dispatching transport stub (the module installs the interceptor and preloads the token at import, so each case steers the stub and the token state): the import-time acquisition is recursion-free (stack depth pinned) and one request; concurrent callers share one request; a forced refresh failure or a 500 is never shadowed by a stale token; a failed refresh is not poisoned; bearer injection and foreign-origin passthrough; a caller's Authorization is kept; the 1 s GET dedupe; mutations never deduped; the heal hook is consulted at once and the bounded retry recovers; a rejected token transport heals in the catch path with no hidden retry and no bearer; a preload bridge wins over the HTTP route. Against the previous config.ts the file's own import-time bootstrap overflows the stack.

Proof: tsc 0 errors; renderer runner 157/157; upstream's linter identical to baseline.

Not in this change (deliberately): an Idempotency-Key retry for mutations — the desktop backend has no idempotency admission (client_message_id is echoed for the optimistic bubble, not deduped), so an automatic retry could run a turn twice; the renderer keeps its one-shot POSTs.