Desktop app: OAuth session_stale_relogin latches and force-logs-out active sessions

**App**: Claude desktop app (macOS), version 1.49585.0
**OS**: macOS (Darwin 25.6.0)

## Summary
Claude Code sessions in the desktop app get force-logged-out because the OAuth token refresh flow fails with `invalid_grant`, and the subsequent fresh `/authorize` attempt is rejected by the server with `403 session_stale_relogin` ("sessionKey is valid but too old for the requested scope expansion"). This forces a full re-login even though the user had an active, valid login session.

## Observed behavior (from `~/Library/Logs/Claude/main.log`)

```
[info] [oauth] CLI requested token refresh after 401
[info] [oauth-v2] refreshing token for orgId=
[error] OAuth token refresh failed: status=400, response=
[info] [oauth-v2] refresh rejected (auth_error) for orgId=; tombstoning and falling through
[info] [oauth-v2] performing fresh /authorize for orgId=
[info] oauth failed: authorize returned 403
[info] oauth authorize rejected with session_stale_relogin; sessionKey is valid but too old for the requested scope expansion
[warn] [CCD CycleHealth] api_error (success): Failed to authenticate. API Error: 401 OAuth access token has expired. Re-authenticate to continue.
```

Once this fires, the failure "latches" — every session warm-up attempt short-circuits with the same `session_stale_relogin` error (`short-circuiting fresh /authorize on latched session_stale_relogin`) until it clears on its own several minutes later (`clearing latched session_stale_relogin failures`). In this occurrence it took about 8 minutes (06:00:04 → 06:08:40) and knocked out every active local session in the meantime.

I also found a much larger burst of the same `invalid_grant`/`session_stale_relogin` pair (~116 occurrences) in an older rotated log (`main4.log`, ~2026-08-22), suggesting this is a recurring issue rather than a one-off.

## What appears to be happening
The failing `/authorize` lookup requests a wider OAuth scope set (`user:inference user:file_upload user:profile user:sessions:claude_code`) than the existing `sessionKey` was granted under. It looks like an app update started requiring an additional scope, but the client doesn't proactively prompt for a fresh interactive login when this happens — it just keeps retrying silently, fails, and logs the user out with all their active local sessions torn down.

## Expected behavior
When the server determines the current `sessionKey` can't cover a newly-required scope, the client should prompt for a clean re-login immediately (or at least surface a clear "please sign in again" state) instead of latching into repeated silent-refresh failures that tear down active sessions for several minutes.

## Local factors ruled out
- System clock is in sync (~0.13s offset from Apple's time server) — not a clock-skew issue.
- App was already on the latest available build when this occurred.

Start by reviewing ~/Library/Logs/Claude/main.log and the older main4.log for the invalid_grant and session_stale_relogin sequence. The issue names no repository files, tests, or entry points, so locate the desktop OAuth refresh and authorize handling before changing anything. Done should mean scope-expansion failures prompt a clear re-login without repeatedly latching or tearing down active sessions.

Scritto dal modello di indicizzazione a partire dal testo della issue.