refactor(api): TOML 配置 SSOT、统一错误契约、Auth/事务加固与可观测性 (#33)

配置 SSOT（TOML + .env）
统一错误契约
Auth 与事务边界
Redis / Celery 可靠性:业务 Redis（DB/0）与 Celery broker/backend（DB/1）显式拆分；连接池、sync client
可观测性（OpenTelemetry + LGTM）

app-expo/tests/core/auth/refresh-lock.test.ts

@@ -0,0 +1,46 @@
+import {
+  resetRefreshLockForTests,
+  withRefreshLock,
+} from '@/core/auth/refresh-lock';
+
+describe('withRefreshLock', () => {
+  beforeEach(() => {
+    resetRefreshLockForTests();
+  });
+
+  it('runs concurrent callers through a single in-flight refresh', async () => {
+    let runs = 0;
+    const fn = jest.fn(async () => {
+      runs += 1;
+      await new Promise((resolve) => setTimeout(resolve, 20));
+      return 'ok';
+    });
+
+    const [a, b, c] = await Promise.all([
+      withRefreshLock(fn),
+      withRefreshLock(fn),
+      withRefreshLock(fn),
+    ]);
+
+    expect(a).toBe('ok');
+    expect(b).toBe('ok');
+    expect(c).toBe('ok');
+    expect(fn).toHaveBeenCalledTimes(1);
+    expect(runs).toBe(1);
+  });
+
+  it('propagates errors to queued waiters', async () => {
+    const fn = jest.fn(async () => {
+      throw new Error('refresh failed');
+    });
+
+    const results = await Promise.allSettled([
+      withRefreshLock(fn),
+      withRefreshLock(fn),
+    ]);
+
+    expect(fn).toHaveBeenCalledTimes(1);
+    expect(results[0].status).toBe('rejected');
+    expect(results[1].status).toBe('rejected');
+  });
+});