[DEVOPS-4768] fix(auth): do not send stale tokenId on login

[Danny Bédard (DannyBedard)]

Après l'expiration de la session DVLS (environ 7 min), le client détecte bien is-logged = false et se reconnecte, mais le login renvoyait le header tokenId expiré, et DVLS rend alors un nouveau jeton déjà mort (401). Le login part maintenant sans tokenId : le jeton est passé explicitement à la fonction interne rawRequestWithContext, sans toucher au jeton partagé ni à l'API publique.

Validé sur dvls-ops : connexion, attente de 8 min, requête. master reçoit 401, cette branche passe. Bump en 0.21.1.

[Copilot]

Copilot review overview

🟡 Changes recommended

Token clearing introduces a race that can cause concurrent requests to omit authentication.

Review effort: Balanced
Findings: 1

Open (1)

• Concurrent token refresh can clear shared token and race API requests · New

What changed in this PR

Fixes token refresh by preventing expired tokens from being sent during login.

Changes:

• Clears expired tokens before re-authentication.
• Omits empty tokenId headers and adds refresh coverage.
• Bumps the patch version.

File	Description
VERSION	Bumps version to 0.21.1.
authentication.go	Clears the token before login.
dvls.go	Omits empty token headers.
dvls_unit_test.go	Tests expired-token refresh.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Copilot review overview

🟡 Changes recommended

Extending the exported options struct breaks consumers using positional struct literals.

Review effort: Balanced
Findings: 1

Open (1)

• Adding unexported field breaks positional RequestOptions literals · New

Resolved since last review (1)

• Concurrent token refresh can clear shared token and race API requests

[Copilot]

Copilot review overview

🟢 Approval recommended

The implementation fixes stale-token reauthentication without changing the public API and includes focused regression coverage.

Review effort: Balanced
Findings: None

Resolved since last review (1)

• Adding unexported field breaks positional RequestOptions literals