fix: use in-memort OAuth stores for httpclient loopback tests

Author: trly

internal/httpclient/AGENTS.md

@@ -18,6 +18,6 @@
 
 ## Tests
 
-- Inject HTTP servers, OAuth options, authorization prompts, and in-memory cache backends; never require a browser, keyring, or real provider.
+- Inject HTTP servers, OAuth options, authorization prompts, and in-memory cache backends; never require a browser, keyring, or real provider. `httpclient.New` uses the production OS keyring by default, so delegated-auth tests, including cancellation and error paths, must call `SetTokenStore(oauthcache.NewWithBackend(...))` before invoking a mutation.
 - Loopback tests bind ports 8085-8089 and must not run in parallel.
 - Run `go test ./internal/httpclient`.

internal/httpclient/client_test.go

@@ -394,6 +394,7 @@ func TestAuthorizationCodeCancellationClosesLoopbackListener(t *testing.T) {
 	defer server.Close()
 
 	client := httpclient.New(ctx, server.URL)
+	client.SetTokenStore(oauthcache.NewWithBackend(&memoryTokenBackend{values: make(map[string]string)}))
 	client.OAuth.ClientID = "public-client"
 	client.OAuth.AuthorizationPrompt = func(string) { cancel() }
 	err := client.Remove(context.Background(), "stable", "x86_64", "example")
@@ -760,6 +761,7 @@ func TestAuthorizationCodeFailsWhenAllLoopbackPortsOccupied(t *testing.T) {
 	defer server.Close()
 
 	client := httpclient.New(context.Background(), server.URL)
+	client.SetTokenStore(oauthcache.NewWithBackend(&memoryTokenBackend{values: make(map[string]string)}))
 	client.OAuth.ClientID = "public-client"
 	err := client.Remove(context.Background(), "stable", "x86_64", "example")
 	if err == nil || !strings.Contains(err.Error(), "all loopback ports") {