lembas login: a refused sign-in starts a new one; 2.0.0-beta.4

With a stored login for the same server, login only refreshed it; a 401
said "run login again", which did the same again. A SignInRejected from
the refresh now falls through to a fresh device login, which replaces the
old one. The installer's last line points at lembas login.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/lembas-login.test.ts

@@ -555,3 +555,17 @@ test("lembas login --token-stdin --server --json: the token from stdin, the devi
   expect((await cli(["login", "--token-stdin", fake.url], "lmb_secret")).code).toBe(2)
   expect((await cli(["login", "--server", fake.url], "lmb_secret")).code).toBe(2)
 })
+
+test("lembas login over a sign-in the instance no longer accepts signs in afresh, not in a loop", async () => {
+  fake = lembas()
+  await login(fake.url, { ...quick, onCode: () => {} })
+  // The instance forgot the token kept here (revoked, or another instance's database).
+  fake.token = "lmb_fresh"
+  fake.polls = 0
+  const r = await cli(["login", fake.url, "--json"], "")
+  expect(r.code).toBe(0)
+  const lines = r.out.trim().split("\n").map((l) => JSON.parse(l))
+  expect(lines[0]).toMatchObject({ event: "code" })
+  expect(lines.at(-1)).toMatchObject({ event: "done", fresh: true, connection: "example" })
+  expect(readFileSync(keyFile("example"), "utf8").trim()).toBe("lmb_fresh")
+})