[Bl0ck154]

Bug

A successful OAuth token refresh rotates the refresh token in accounts.json. If the active Codex auth.json still contains an older snapshot, the next reconciliation can overwrite the new token with the old, single-use refresh token. This makes switching back or refreshing later fail.

Fix

Extract the credential-generation safeguard from upstream PR Lampese#185 without importing the unrelated OAuth refresh policy overhaul:

• Add optional, backward-compatible last_refresh_at to saved accounts.
• Preserve generations when importing auth.json and when writing it out on account switches.
• Record a new generation on successful OAuth token refresh or re-login.
• Reconcile live credentials only if they belong to the same workspace and are not older than the saved generation.
• Keep unknown-identity and workspace isolation protections unchanged.

Regression coverage

Four storage tests:

• Older runtime snapshot (including missing timestamp) cannot overwrite a rotated token.
• A newer runtime generation can update the saved credentials.
• Legacy accounts.json without the field still deserializes.
• Re-login retains new credentials even if the runtime still has an older snapshot.

This patch is separated from upstream Lampese#185 because the full PR conflicts with our workspace-aware OAuth changes. Rust CI and platform compile checks are pending. Do not merge if they fail.