fix(auth): address Claude review on OAuth persist serialization

Serialize persist() in OAuthStorageBase so overlapping remote POSTs cannot
reorder and clobber state. Regenerate launcher package-lock.json to drop
stale zustand entries. Let parseOAuthPersistBlob accept parsed objects
from res.json() without a redundant JSON round-trip.

clients/web/src/test/core/auth/oauth-persist.test.ts

@@ -21,6 +21,16 @@ describe("parseOAuthPersistBlob", () => {
     expect(parseOAuthPersistBlob(JSON.stringify(snapshot))).toEqual(snapshot);
   });
 
+  it("accepts an already-parsed object without re-serializing", () => {
+    const snapshot = {
+      servers: {
+        "http://example.com": { codeVerifier: "v1" },
+      },
+      idpSessions: {},
+    };
+    expect(parseOAuthPersistBlob(snapshot)).toEqual(snapshot);
+  });
+
   it("promotes legacy persist envelope state to the top level", () => {
     const legacy = {
       state: {