feat(auth): add force option and runWithAuthRetry helper

GitHub refresh tokens are single-use, so concurrent refreshes race and
the loser ends up with a revoked token — dedupe in-flight calls.

src/modules/repo/services/octo.ts

@@ -1,6 +1,6 @@
 import { Octokit } from "@octokit/rest"
 
-import { getAccessToken } from "@/modules/user/service/signIn"
+import { getAccessToken, refreshToken } from "@/modules/user/service/signIn"
 
 export const DEFAULT_OCTOKIT_TIMEOUT_MS = 8_000
 
@@ -20,3 +20,21 @@ export const getOctokit = async (): Promise<Octokit> => {
 
   return octokit
 }
+
+const isUnauthorized = (error: unknown): boolean =>
+  (error as { status?: number })?.status === 401
+
+// Runs an Octokit call; on 401, force-refreshes the token and retries once.
+// Rethrows the original error if the refresh fails or the retry still 401s.
+export const runWithAuthRetry = async <T>(
+  call: (octokit: Octokit) => Promise<T>
+): Promise<T> => {
+  try {
+    return await call(await getOctokit())
+  } catch (error) {
+    if (!isUnauthorized(error)) throw error
+    const refreshed = await refreshToken({ force: true }).catch(() => null)
+    if (!refreshed) throw error
+    return await call(await getOctokit())
+  }
+}