fix: fix Web Console hanging when SSO token refresh fails

[glasstiger]

Problem

When OIDC token refresh rejected (for example, because the IdP was unreachable or returned a non-JSON 502 response), the rejection escaped an async setInterval callback. The shared refreshTokenPending flag never cleared, so the Web Console stopped running queries until the page was reloaded. A refresh that never settled could leave it waiting just as long.

Fix

• Use a single shared in-flight refresh promise. Queries wait on it without polling, and cancelling a query releases that waiter without cancelling the refresh for other queries.
• Bound the entire refresh (including reading the response body) to 10 seconds. Abort the IdP request on timeout, discard late responses, catch failures, and release non-cancelled waiting queries.
• Replace the unnecessary in-flight-query drain: requests already capture their headers when they start. A slow SQL query no longer delays refreshing the token or blocks other queries.
• Keep the current token after a refresh failure. It may still be valid inside the 30-second refresh window. Retry with capped backoff instead of posting to the IdP on every query; reset backoff on success or a new login. While the old token is still valid, queries may succeed; a 401 follows only when it expires or is revoked.
• Notify the user on refresh failure and show an explanatory login error if the session subsequently expires. Count only the first 401 from a burst of in-flight queries after logout, preserving the saved SSO shortcut and silent re-authentication. Repeated failures across separate login attempts still trigger the redirect-loop guard.

Testing

• Unit tests cover successful header updates while another query is in flight, header preservation on failure, shared concurrent waiters, cancelling a waiter, retry backoff, session reset, hung refresh timeout, late responses, OAuth error bodies, and 401-burst handling.
• Enterprise OIDC E2E cases added for both a refresh network error and a non-JSON 502 during login. These require an EE QuestDB/OIDC test environment and were not run locally.
• Local typecheck, lint, full unit suite, and production build pass.

[github-actions]

Web Console deploy preview

Preview	Commit	Logs
https://pr-603--web-console.netlify.app	c24e68e	build log