[Test] Auth multi-provider edge cases + permission re-sync #968

Parent epic: #773 — fills feature-list 1.x and 2.2.x

Summary

Existing auth specs (login-flow, logout-relogin-onboarding, auth-access-control) cover happy paths. Missing: multi-provider account linking, duplicate-account handling, refresh-token rotation, and permission lifecycle re-sync.

Scope

• app/test/e2e/specs/auth-multi-provider-linking.spec.ts — 1.2.2 link Google + GitHub + Twitter + Discord to single account, 1.2.3 duplicate account collision handling.
• app/test/e2e/specs/auth-token-refresh.spec.ts — 1.3.3 refresh token rotation, expiry handling, invalid refresh recovery.
• app/test/e2e/specs/auth-global-logout.spec.ts — 1.4.2 global logout invalidates all sessions, 1.4.3 token invalidation propagation.
• app/test/e2e/specs/permission-resync.spec.ts — 2.2.3 re-sync on app restart, 2.2.4 partial-permission state handling. macOS-only — guard with isMac2().
• Vitest: app/src/store/__tests__/authSlice.refreshRotation.test.ts — slice-level refresh logic.
• Update matrix rows 1.2.2, 1.2.3, 1.3.3, 1.4.2, 1.4.3, 2.2.3, 2.2.4 from 🟡/❌ → ✅.

Constraints

• TCC OS prompts (2.1.x) NOT in scope — those are manual smoke per docs/TESTING-STRATEGY.md.
• Mock backend simulates token rotation + revocation endpoints.

Acceptance

• 4 WDIO specs + 1 Vitest land.
• Matrix updated.
• Linux CI green; macOS Appium spec runs locally.