fix: address critical code review issues (4 fixes)

This commit addresses 4 critical issues identified in code review:

1. **Token Rotation Race Condition** (token_broker.py)
   - Added per-user locking mechanism to prevent concurrent refresh token corruption
   - Implemented double-check pattern for cache after acquiring lock
   - Users can now safely refresh concurrently without token desync

2. **Hardcoded OAuth Client ID** (PHP files)
   - Made client ID configurable via `astroglobe_client_id` in system config
   - Updated McpServerClient to provide getClientId() method
   - Injected McpServerClient into IdpTokenRefresher and OAuthController
   - Updated admin settings UI to display client ID configuration status
   - App gracefully handles missing client ID with warnings in admin UI

3. **Missing Cache Invalidation** (management.py:revoke_user_access)
   - Added cache.invalidate() call when revoking user access
   - Ensures both storage AND cache are cleared atomically
   - Prevents stale cached tokens from being used after revocation

4. **Error Message Exposure** (management.py)
   - Created _sanitize_error_for_client() helper function
   - Updated all error handlers to log detailed errors internally
   - Returns generic messages to clients to prevent information leakage
   - Protects against exposing database paths, API URLs, tokens, etc.

All changes are backward compatible and preserve existing functionality.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

third_party/astroglobe/lib/Settings/Admin.php

@@ -54,6 +54,8 @@ class Admin implements ISettings {
 		// Get configuration from config.php
 		$serverUrl = $this->config->getSystemValue('mcp_server_url', '');
 		$apiKeyConfigured = !empty($this->config->getSystemValue('mcp_server_api_key', ''));
+		$clientId = $this->config->getSystemValue('astroglobe_client_id', '');
+		$clientIdConfigured = !empty($clientId);
 		$clientSecret = $this->config->getSystemValue('astroglobe_client_secret', '');
 		$clientSecretConfigured = !empty($clientSecret);
 
@@ -112,6 +114,7 @@ class Admin implements ISettings {
 			'vectorSyncStatus' => $vectorSyncStatus,
 			'serverUrl' => $serverUrl,
 			'apiKeyConfigured' => $apiKeyConfigured,
+			'clientIdConfigured' => $clientIdConfigured,
 			'clientSecretConfigured' => $clientSecretConfigured,
 			'vectorSyncEnabled' => $serverStatus['vector_sync_enabled'] ?? false,
 			'searchSettings' => $searchSettings,