fix(auth): address Claude review on OAuth persist serialization

Serialize persist() in OAuthStorageBase so overlapping remote POSTs cannot
reorder and clobber state. Regenerate launcher package-lock.json to drop
stale zustand entries. Let parseOAuthPersistBlob accept parsed objects
from res.json() without a redundant JSON round-trip.

core/auth/oauth-storage.ts

@@ -24,6 +24,8 @@ import type {
 export class OAuthStorageBase implements OAuthStorage {
   private loaded = false;
   private loadPromise: Promise<void> | undefined;
+  /** Serializes persist writes so concurrent mutators cannot reorder POSTs. */
+  private persistQueue: Promise<void> = Promise.resolve();
   private readonly memory: OAuthMemoryStore;
   private readonly backend: OAuthPersistBackend;
 
@@ -55,7 +57,13 @@ export class OAuthStorageBase implements OAuthStorage {
   }
 
   private async persist(): Promise<void> {
-    await this.backend.write(this.memory.snapshot());
+    const snapshot = this.memory.snapshot();
+    const prior = this.persistQueue;
+    const tracked = prior
+      .catch(() => {})
+      .then(() => this.backend.write(snapshot));
+    this.persistQueue = tracked;
+    await tracked;
   }
 
   async getClientInformation(