## Why
Credential I/O can block async workers, and canceled browser logins must not release the credential store lock while a write is still running. Provider errors can also echo secrets from authorization URL query parameters.
## What changed
- Move credential reads and writes to `spawn_blocking`, retaining the cross-process lock until encryption and the atomic write finish, even if the caller is canceled.
- Clear pending rotated credentials during browser login only when stored credentials have changed, preserving recovery after a failed login without overwriting an external login.
- Omit provider response details and request IDs when the authorization URL contains query parameters, matching the existing protection for token and resource URLs.
## Testing
Extend regression coverage for authorization URL query-secret redaction and failed browser login after a failed credential save, including retry, expiration, and external-login recovery.
GitOrigin-RevId: 4a63702a260fd7f3e2ad2314b0124c0d647d4f12
alexsong-oai
9f22ba8039