test(auth): cover persist-failure and lock-degrade paths

- ensure_returns_token_even_when_session_persist_fails: a read-only
  config dir must not fail the refresh — the caller still gets the
  token, the on-disk session stays stale, and the failed lock
  acquisition exercises the unlocked degrade.
- lock_file_degrades_to_none_when_config_dir_unavailable: pointing the
  config dir at a regular file must yield None (proceed unlocked), not
  an error or a hang.

Author: eddietejeda

src/client/jwt.rs

@@ -1187,6 +1187,40 @@ mod tests {
         );
     }
 
+    #[test]
+    fn ensure_returns_token_even_when_session_persist_fails() {
+        // A refreshed token must reach the caller even when session.json
+        // can't be written (read-only config dir): the persistence failure
+        // is warned about, not fatal. The lock acquisition also fails here
+        // (session.lock can't be created), exercising the unlocked degrade.
+        use std::os::unix::fs::PermissionsExt;
+        let (_tmp, _guard) = with_temp_config_dir();
+        let mut server = mockito::Server::new();
+        let m = server
+            .mock("POST", "/o/token/")
+            .match_body(mockito::Matcher::UrlEncoded(
+                "grant_type".into(),
+                "refresh_token".into(),
+            ))
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(r#"{"access_token":"refreshed-jwt","expires_in":300,"refresh_token":"r2"}"#)
+            .create();
+
+        save_session(&cached_session(-10, 86400)).unwrap();
+        let profile = mock_profile(&server.url());
+
+        let dir = config::config_dir().unwrap();
+        fs::set_permissions(&dir, fs::Permissions::from_mode(0o555)).unwrap();
+        let result = ensure_access_token(&profile, None);
+        fs::set_permissions(&dir, fs::Permissions::from_mode(0o755)).unwrap();
+
+        m.assert();
+        assert_eq!(result.unwrap(), "refreshed-jwt");
+        // The on-disk session couldn't be updated — still the old one.
+        assert_eq!(load_session().unwrap().access_token, "cached-jwt");
+    }
+
     #[test]
     fn ensure_concurrent_expiry_refreshes_once_and_shares_result() {
         // Regression: when the access token expired mid-burst, N concurrent

src/config.rs

@@ -436,6 +436,25 @@ mod tests {
         assert_eq!(staging.workspaces[0].public_id, "ws-staging");
     }
 
+    #[test]
+    fn lock_file_degrades_to_none_when_config_dir_unavailable() {
+        // Locking is best-effort: when the config dir can't even be
+        // created (here: the path is a regular file), lock_file must
+        // degrade to None — warn and proceed unlocked — not error or hang.
+        let (tmp, _guard) = with_temp_config_dir();
+        let not_a_dir = tmp.path().join("not-a-dir");
+        fs::write(&not_a_dir, "x").unwrap();
+        // SAFETY: serialized via with_temp_config_dir's ENV_LOCK guard.
+        unsafe {
+            std::env::set_var("HOTDATA_CONFIG_DIR", &not_a_dir);
+        }
+        let lock = lock_file("config.lock");
+        unsafe {
+            std::env::set_var("HOTDATA_CONFIG_DIR", tmp.path());
+        }
+        assert!(lock.is_none());
+    }
+
     #[test]
     fn config_file_stays_world_readable() {
         // The atomic-write path must not silently flip config.yml from the