Normalize broker URL before V2 refresh deduplication #91

Summary

V2 refresh deduplication keys on the raw brokerBaseUrl string. URL-equivalent settings such as https://host/broker and https://host/broker/ therefore create different keys, even though makeBrokerRequest() strips the trailing slash and sends both requests to the same /refresh endpoint.

With the same refresh token used across two Locations configured with these aliases, concurrent refresh calls bypass deduplication and send the credential to the same endpoint twice.

Evidence

The final auth review added a scratch adversarial test that configured both URL forms and observed two concurrent requests to the exact same endpoint. The reproducer is not committed.

Related: PR #87, reviewed at 008c8d7ff4b3a2e01cf2b1867913a9bb6598197e.

Expected behavior

Equivalent broker base URLs produce the same refresh-deduplication key, without merging genuinely different broker endpoints or accounts.

Acceptance criteria

• Normalize the broker URL for the deduplication key using URL semantics consistent with makeBrokerRequest().
• Add a regression test using trailing-slash aliases and the same refresh token; only one broker request should occur while both calls are in flight.
• Keep different paths/origins and different refresh tokens isolated.

Severity

Low. Configuration-shaped duplicate refresh race; no account mixing or token exposure was observed.