fix: prevent stale async credential clears from overwriting a freshly-set token [IDE-2106]

[basti-snyk]

Summary

• Fixes the flaky Test_E2E_AuthenticationMethodChangeClearsIncompatibleToken (Windows CI, IDE-2106), where switching auth method and setting a token in one didChangeConfiguration sometimes left the token empty.
• Root cause: on that path applyAuthenticationMethod runs before applyToken. ConfigureProviders/logout enqueue empty-token clears through the async OAuth storage bridge (QueueCredentialUpdate("")). The single credentialUpdateWorker could drain those stale clears after applyToken's synchronous UpdateCredentials wrote the real token, wiping it.
• Fix: a monotonic syncGeneration counter on AuthenticationServiceImpl. The increment lives in the private updateCredentials, so every synchronous writer (UpdateCredentials, authenticate, logout) supersedes earlier-queued async updates; the worker discards any update whose generation predates the latest synchronous write — a strict happens-before. The worker now holds a.m only for the generation check + token mutation and releases it before running the postCredentialUpdateHook, removing a reentrancy deadlock hazard.
• Adds regression tests for the authenticate, logout, and rapid-rotation paths plus a worker-hook no-deadlock test.

Test plan

• go test ./infrastructure/authentication/... -race green
• Test_E2E_AuthenticationMethodChangeClearsIncompatibleToken proven RED before fix, 200/200 GREEN after (-race, -cpu=1,2,4)
• New unit tests RED-without-fix / GREEN-with-fix for authenticate + logout paths
• make test (full unit suite) green at this commit
• CI integration + smoke suites (run on PR)

---

This fix was produced by an automated flake-fix loop.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 19 relevant code sections from 13 files (average relevance: 1.00) infrastructure/authentication/auth_service_impl.go (3 segments, lines 1-159) application/config/token_service.go (lines 1-105) infrastructure/authentication/provider_fake.go (lines 1-140) domain/ide/command/login.go (lines 1-133) infrastructure/authentication/initializer.go (lines 1-91) infrastructure/authentication/auth_configuration.go (lines 1-186) domain/ide/command/apply_auth_config.go (lines 1-84) ... and 6 more file(s)