test(api): enforce race coverage for token cache

[rabesss]

Summary

Fixes #255.

• Add go test -race -count=1 -timeout 5m ./internal/client/... to CI
• Exercise distinct tokens and assert recorded Authorization headers and request errors
• Replace two external-network request-building tests with recording transports, preserving and strengthening request assertions

The race step is deliberately client-only; unrelated process timing issue #259 remains separate. No production code changes.

Validation

• Exact new client race CI command passes
• Temporary lock-free Go overlay removes only eight token mutex lock/unlock calls: both regression tests fail with three DATA RACE reports
• Real token tests pass 20 repetitions at each GOMAXPROCS 1, 2 and 4
• Independent reviewer repeated the race command and negative-control proof successfully
• Full vet, golangci-lint v2.12.1 (0 issues), and build with -buildvcs=false pass

Full go test ./... was attempted. All packages except the nine pre-existing player tests pass; this sandbox prohibits AF_UNIX sockets. Worktree builds require -buildvcs=false due to the environment's VCS lookup. Hosted CI and Security passed on the final head: https://github.com/rabesss/impartus-cli/actions/runs/37479525609. The latest title check also passes.