feat(ai): added auth-broker snapshot contract with generation checks

- Added generation-aware snapshot contracts with generation, serverNowMs, refresher, and rotatesInMs fields.
- Reworked /v1/snapshot serving and client fetching for If-None-Match long-poll with 304/200 status handling.
- Added status checks in remote-store and SDK/CLI snapshot paths, applying updates only when fetch returns 200.
- Added StreamOptions.onAuthError and stream one-shot 401 retry dispatch using refreshed credentials.

packages/coding-agent/src/cli/auth-broker-cli.ts

@@ -542,8 +542,9 @@ async function runMigrate(flags: AuthBrokerCommandArgs["flags"]): Promise<void>
 	}
 
 	const client = new AuthBrokerClient({ url: brokerConfig.url, token: brokerConfig.token });
-	const snapshot = await client.fetchSnapshot();
-	const existing = indexBrokerSnapshot(snapshot);
+	const snapshotResult = await client.fetchSnapshot();
+	if (snapshotResult.status !== 200) throw new Error("Auth broker returned no snapshot");
+	const existing = indexBrokerSnapshot(snapshotResult.snapshot);
 
 	const plan: MigratePlanEntry[] = [];
 	const skipped: MigrateSkip[] = [];

packages/coding-agent/src/cli/auth-gateway-cli.ts

@@ -123,7 +123,9 @@ function createBrokerClient(brokerConfig: AuthBrokerClientConfig): AuthBrokerCli
 }
 
 async function fetchBrokerSnapshot(client: AuthBrokerClient): Promise<SnapshotResponse> {
-	return client.fetchSnapshot();
+	const result = await client.fetchSnapshot();
+	if (result.status !== 200) throw new Error("Auth broker returned no initial snapshot");
+	return result.snapshot;
 }
 
 async function runServe(flags: AuthGatewayCommandArgs["flags"]): Promise<void> {