fix: address the four suppressed findings from review round 20 (#2144)

Copilot reported "no new comments" again, with four real findings in its
suppressed block.

- The web in-flight lock was global, so a pending clear for server A silently
  swallowed a click on server B's — even though the callback explicitly
  supports clearing a non-active server. Keyed by server id now.
- `else if (!isActive)` skipped the resume-snapshot cleanup when the target IS
  active but has no client yet, which is reachable while a session is being
  built or torn down. The clear then emptied storage and left stale OAuth
  recovery state pointing at credentials that no longer existed.
- `revocationAuthMethods` returned `[]` for an omitted
  `revocation_endpoint_auth_methods_supported`, which does not enforce RFC
  8414's default: an empty list means "the metadata said nothing" to
  `selectClientAuthMethod`, which then honors the registration's own
  `token_endpoint_auth_method`. The default is named literally now.
- The `v8 ignore` on the CLI budget branch was wrong, and the challenge to it
  was right: an injected `budgetMs` of zero reaches it directly, through a seam
  I had added myself the round before. Removed, and covered by a test that
  asserts no request is made and the unattempted key is reported.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0177mPHAdECD18nLLCTwR5rh
Signed-off-by: cliffhall <cliff@futurescale.com>

core/auth/revocation.ts

@@ -104,14 +104,20 @@ export function selectRevocableToken(
  * there send POST credentials to a revocation endpoint that never advertised
  * that method, which a strict server rejects.
  *
- * An empty result is returned rather than a literal `["client_secret_basic"]`
- * because that is what makes {@link selectClientAuthMethod} apply exactly the
- * RFC's default — `client_secret_basic` when the client holds a secret, `none`
- * when it does not — while still honoring a `token_endpoint_auth_method` the
- * client's own registration declares.
+ * The default is returned **literally** rather than as an empty list. An empty
+ * list does not mean "apply the RFC default" to `selectClientAuthMethod`: it
+ * means "the metadata said nothing", and the SDK then honors whatever
+ * `token_endpoint_auth_method` the client's own registration declares. A DCR
+ * client registered `client_secret_post` would therefore put its credentials
+ * in the body of a request to an endpoint that promised only Basic, and the
+ * revocation would fail. Naming the default is what actually enforces it.
  */
 export function revocationAuthMethods(metadata: CachedMetadata): string[] {
-  return metadata.revocation_endpoint_auth_methods_supported ?? [];
+  return (
+    metadata.revocation_endpoint_auth_methods_supported ?? [
+      "client_secret_basic",
+    ]
+  );
 }
 
 export interface RevocationRequestParams {