fix: auth/sync robustness (5 review mediums)

[vreshch]

Fixes the 5 MEDIUM findings from the desktop-only re-review. No version bump — bundled into the upcoming 0.2.0 with the public-prep PR.

• Zombie session — a failed/expired token refresh left stale tokens, so isSignedIn() stayed true: green dot, every sync fails. Now a 4xx refresh (invalid/expired/revoked) clears the session + flips the UI to signed-out + notices "session expired"; a 5xx/network blip keeps tokens (retryable). New typed OAuthHttpError carries the status. oauth.ts, auth-flow.ts (+2 tests).
• Disconnect kept the selected memory → re-sign-in showed a stale/deleted memory as active. Disconnect now clears vault+lastVault → next session starts at "Choose Memory". main.ts
• Chooser hid server errors as "No memories yet" — listVaults now returns a result ({ok,vaults} | {ok:false,error}); the chooser shows "Couldn't load your memories: … + Retry" distinct from the empty state. settings.ts, main.ts, memory-chooser.ts
• push() retry swallowed a conflict — a non-ff re-pull that conflicts is now propagated (no blind re-push → "not ok after rebase"); push() returns the conflict outcome. git-client.ts, sync-controller.ts
• Criss-cross merge — MergeNotSupportedError no longer bubbles raw; pull() returns {unmergeable:true} and the controller surfaces an actionable "diverged too far — resolve and sync again" message (no silent LWW). Misleading comment removed.

Also adds: chooser "Use & sync" on non-current rows.

npm run verify green (68 tests, build, host/docs/bundle checks).

[github-actions]

🎉 PR Validation ✅ PASSED

Commit: e2676ab6e5bf2b86099fafb9d10ef2a609d9b15c
Branch: feature/robustness

Checks:

• ✅ Dependencies installed
• ✅ Type check passed
• ✅ Linting passed
• ✅ Format check passed
• ✅ Tests + coverage passed
• ✅ Build successful
• ✅ Store-compliance checks passed
• ✅ Bundle is mobile-safe

Ready to merge! ✨

---

🔗 View workflow run