fix(auth): sweep refresh revocations until a pass finds nothing (#725)

[alex-dembele]

Closes #725

What was wrong

#775 fixed the race #725 describes: after storing its successor, a rotation checks that its claimed row (the witness) still exists. That check only works once the revoking DELETE has committed. On Postgres, under READ COMMITTED, a DELETE reads from the snapshot taken when it starts, and its deletions stay invisible until it commits. So a rotation can store its successor after that snapshot, still see the witness, and hand the successor out, which survives the revocation.

This affects all three revokers:

• revokeFamily, on reuse or lost membership;
• RevokeAllUserTokens, on password change or reset;
• RevokeUserTokensInTenant, on member deactivation or role change.

SQLite serialises writers, so the existing tests could not show it.

Mechanism

sweepRefreshTokens repeats the DELETE until a pass removes nothing, with at most 5 passes. Let P be the last, empty pass. A successor committed before P started was visible to an earlier pass, so it is gone. A successor committed after P started has its witness checked after the earlier passes committed, so the rotation finds no witness, revokes the family itself and refuses. The full argument is in token.go, next to the sweep and next to the witness check.

The refresh path is unchanged: no lock, no transaction, no extra query. Revocation costs one extra DELETE that removes nothing. There is no schema change and no new dependency.

Tests

• token_pg_test.go (new, needs DATABASE_URL, runs on its own schema): parks the revoking DELETE behind a row lock to force the interleaving, for all three revokers. It fails on master (1 token survives in each case) and passes with the fix.
• TestSweepRefreshTokens_TakesARowStoredBehindIt (SQLite): fails on master, passes with the fix.

$ go test ./internal/auth/ -run TestRefresh -count=50 -race
ok  	github.com/opendefender/openrisk/internal/auth	49.553s
$ DATABASE_URL=… go test ./internal/auth/ -run Postgres -count=20 -race
ok  	github.com/opendefender/openrisk/internal/auth	20.246s

go test ./...: 78 packages pass. internal/handler and cmd/server fail to build on master itself (saml2_handler.go, #886), and this branch does not touch them.

Spec: docs/725_REFRESH_REVOCATION_RACE.md. This touches auth, so it should get a tech-lead review before merge.