OAuth token refresh has a race condition. Fix it with a conditional write, not a distributed lock.

Concurrent refreshes don’t just fail. They can disconnect the user entirely. Here are four layers of defense, cheapest first, and why the Redis lock everyone reaches for isn’t the one keeping you safe.