fix(config): add cross-process file locking and config.Modify to prev…

[Adityakk9031]

Summary

Fixes #8.

Resolves a destructive race condition where concurrent processes (such as a long-running codag mcp serve session running in parallel with CLI commands) execute whole-struct config.Load -> mutate -> config.Save cycles, overwriting rotated OAuth refresh tokens with stale in-memory data and causing spurious user logouts.

Root Cause

• In-process sync.Mutex (fileMu) only serialized goroutines within a single process instance, leaving concurrent OS processes un-synchronized.
• Full-file overwrites (config.Save) wrote back stale token structs if loaded prior to a token rotation.
• Concurrent anonymous token minting lacked singleflight deduplication.

Key Changes

1. Cross-Process File Locking: Added OS file locking primitives (flock on Unix / LockFileEx on Windows) on config.json.lock in internal/config.
2. config.Modify API: Introduced config.Modify(func(cfg *Config) error) which re-loads the latest state under the file lock, applies only the specific caller's delta, and saves atomically.
3. Refactored Callers: Updated OAuth token saves, anonymous token minting, update checker, analytics distinct-ID creation, CLI config setters, and onboarding state to use config.Modify.
4. Single-Flight Deduplication: Wrapped ensureAnonymousToken with singleflight.Group to prevent stampedes on initial run.
5. Tests: Added TestModifyConcurrentDeltas in config_test.go to ensure concurrent delta writes retain rotated tokens and distinct fields.

Verification

• Added unit tests covering concurrent delta modifications.

[Adityakk9031]

@michaelzixizhou have a look

[Adityakk9031]

@michaelzixizhou have a look