fix(auth): retry on 401 invalid_client by reloading device registration from SQLite

[KenEzekiel]

Problem

When kiro-cli login is run while the gateway container is already running, the device registration (client_id/client_secret) in SQLite gets rotated. The gateway's in-memory credentials become stale.

Previously, only HTTP 400 (invalid_grant — stale refresh_token) triggered a SQLite reload and retry. But a rotated device registration returns HTTP 401 (invalid_client — stale client_secret), which was not caught — causing permanent auth failure until the container was restarted.

Error sequence observed:

1. First refresh attempt → 401 invalid_client (stale client_secret in memory)
2. Gateway does not retry → raises ValueError → returns HTTP 500 to clients
3. All subsequent requests also fail with 500

Fix

• _refresh_token_aws_sso_oidc(): now retries on both 400 and 401 by reloading all credentials (token + device registration) from SQLite
• get_access_token() graceful degradation: also handles 401 in the fallback path
• Added test for the 401 retry scenario
• Updated docstrings and existing test descriptions

Testing

• Added test_refresh_token_aws_sso_oidc_retries_on_401_invalid_client — verifies 401 triggers SQLite reload and successful retry
• Existing 500 non-retry test still passes (only 400/401 are retried)

[cla-bot]

Thanks for the PR! 🎉

Before merge, we need a one-time CLA confirmation.
It confirms that you have the right to contribute this code and allow the project to use it.

Full CLA text:
https://github.com/jwadow/kiro-gateway/blob/main/CLA.md

Please reply once with:

I have read the CLA and I accept its terms

You need to write once, all further messages from me can be ignored.

[KenEzekiel]

I have read the CLA and I accept its terms

[KenEzekiel]

Thanks for the PR! 🎉

Before merge, we need a one-time CLA confirmation. It confirms that you have the right to contribute this code and allow the project to use it.

Full CLA text: https://github.com/jwadow/kiro-gateway/blob/main/CLA.md

Please reply once with:

I have read the CLA and I accept its terms

You need to write once, all further messages from me can be ignored.

I have read the CLA and I accept its terms

[KenEzekiel]

I have read the CLA and I accept its terms