swarmctl: serve login callbacks concurrently, retry a refused token once, test the refresh lock and the socket path

The loopback listener served one connection at a time with no read
timeout, so a connection that never sent a request (a browser preconnect,
any local process) held up the real form_post until the 5-minute wait
ran out. Each connection now runs on its own task and the first final
answer wins. The callback body is capped at 16 KiB; over the cap it reads
as empty and can't complete the login.

A request the gateway answers 401 now triggers one refresh (under the
cache lock, skipped if another process already replaced the refused
token) and one retry; a second 401 says to run `swarmctl login`.

The login cache directory is a `Swarm` field so tests can point it at a
scratch directory. New tests: an idle connection does not block the real
callback; an oversized body is refused without ending the wait; two
concurrent refreshers refresh once and share the token; a refused token
is refreshed once and retried; a second 401 says to log in without a
further retry; with no `--swarm`, the verbs use the controller socket.

swarmctl/README.md

@@ -188,8 +188,9 @@ $ swarmctl schedule list
 `login` opens the swarm's SSO login in a browser and receives the result on
 a loopback port, so run it on the machine whose browser you use. swarmctl
 keeps the login, mode 0600, under `$XDG_STATE_HOME/swarmctl/` (default
-`~/.local/state`) and refreshes it as it's used. When it can't be refreshed,
-any verb says to run `swarmctl login` again. To log out, delete the file.
+`~/.local/state`) and refreshes it as it's used, and once more if the gateway
+refuses it. When it can't be refreshed, any verb says to run `swarmctl login`
+again. To log out, delete the file.
 
 A swarm whose gateway serves a certificate from the swarm's own CA needs
 that CA: `--ca-file` or `SWARMCTL_CA_FILE`. The `user` verbs edit the local