Persist localhost OAuth client identity across refresh #70

Summary #

• Persist the loopback OAuth client_id / callback URL on the keyring account at login.
• Restore that identity before ResumeSession, so token refresh uses the same localhost client that minted the grant.
• Keep those fields across token refresh, and stop mapping invalid_client_metadata to "Session expired".

ATProto localhost clients encode the redirect URI in client_id. tg auth login binds an ephemeral port, then later processes reconstructed NewLocalhostConfig("") and sent redirect_uri= on refresh. Bluesky returned HTTP 400 invalid_client_metadata, and tg auth status reported the still-present session as expired.

Existing sessions still need one tg auth login after this lands so the client identity is stored.

Test plan #

• go test ./atproto ./internal/app ./internal/cli
• tg auth login
• Wait for the access token to expire, then tg auth status / tg pipeline list without being asked to log in again
• Confirm a missing stored client identity asks for tg auth login instead of "Session expired"

"There are only two hard things in Computer Science: cache invalidation and naming things." - Phil Karlton

Written by Cameron ◯ Letta Code