fix(example): prevent overlapping auth actions and late UI updates

[OskarEichler]

Fixes

Use one synchronous pending guard for login/refresh/revoke so a late refresh cannot merge tokens into another provider’s state. Disable and label pending controls, ignore results/errors after unmount, handle optional prefetch failure, preserve refresh-token rotation fallback, and simplify derived revoke visibility. Remove incompatible readonly scope assertions. Clarify that the Expo sample only clears local state rather than revoking the provider session.

Breaking / observable changes

Examples only. Library APIs are unchanged. Demo buttons cannot initiate another auth action until the current one settles; native button semantics and disabled state are exposed, with a polite pending status. No screen-reader or visual-conformance claim.

Verification

Seven actual React-rendered checks pass (four fail on the baseline), including rapid double activation, refresh/login overlap, unmount/error, recovery, token rotation fallback and revocation reset. Demo TypeScript and targeted ESLint pass; both production Metro bundles and native demo builds pass.

Each patch was applied independently to upstream commit 6f9090ce1b991c0acc2a6f5dc8bea838deaf4f7a and passed its targeted external actual-source diagnostics or standalone type/lockfile check. The combined fixes pass 75 focused diagnostics. These use synthetic values, controlled native/bridge doubles and disposable filesystem projects, not real credentials.

Combined branch checks:

• Existing Jest suite: 3 suites, 81 tests pass.
• Root lint, demo lint, targeted App.tsx lint, demo TypeScript and standalone public-type checks pass.
• Expo plugin TypeScript build passes. The optional lint:plugin command has a baseline tooling limitation: ESLint 6 does not find its TypeScript-only input.
• Android Debug demo build passes with RN 0.79.2.
• Unsigned iOS Simulator Debug demo build passes with RN 0.79.2.
• Android and iOS production Metro demo bundles pass.
• git diff --check passes.

No checked-in test/spec files were added, changed or disabled. The source changes are supported by external reproducible diagnostics because this audit's repository policy prohibits checked-in test edits. Live OAuth providers, physical-device/browser authentication and a full Expo native build were not exercised. React Doctor reports two warnings: the discovery response is explicitly guarded by response.ok === false, and the demo pending reset is inside finally; both paths are exercised by focused checks. No rules were suppressed.

Scope

• examples/demo/App.tsx
• examples/expo-cng/App.tsx

Unrelated audit fixes are submitted separately. The separate iOS process-global OIDURLSessionProvider request-isolation issue is not claimed fixed by these changes.

[vercel]

@OskarEichler is attempting to deploy a commit to the Nearform Team on Vercel.

A member of the Team first needs to authorize it.