fix(auth): drain response body on non-ok cross-tab fetch

Consumes the response body via r.body.cancel() when the cross-tab
/user fetch returns a non-OK status, preventing connection pool
drain on repeated events.

Also strengthens the input-cleared test to reopen the form and
verify the input signal was actually reset, not just that the DOM
element was removed.

Author: wgordon17

src/app/stores/auth.ts

@@ -349,7 +349,7 @@ if (typeof window !== "undefined") {
       fetch("https://api.github.com/user", {
         headers: { ...VALIDATE_HEADERS, Authorization: `Bearer ${newToken}` },
       })
-        .then((r) => r.ok ? r.json() as Promise<GitHubUser> : null)
+        .then((r) => { if (!r.ok) { void r.body?.cancel(); return null; } return r.json() as Promise<GitHubUser>; })
         .then((data) => {
           if (data && _token() === newToken && _crossTabFetchGen === gen) {
             setUser({ login: data.login, avatar_url: data.avatar_url, name: data.name });

tests/components/settings/SettingsPage.test.tsx

@@ -566,8 +566,13 @@ describe("SettingsPage — replace token", () => {
     const cancelBtn = screen.getByRole("button", { name: "Cancel" });
     await user.click(cancelBtn);
 
-    // Form is gone and input is cleared
+    // Form is gone
     expect(screen.queryByRole("button", { name: "Replace token" })).toBeNull();
+
+    // Reopen and verify input was cleared
+    await user.click(screen.getByRole("button", { name: "Replace" }));
+    const reopenedInput = screen.getByLabelText(/new personal access token/i) as HTMLInputElement;
+    expect(reopenedInput.value).toBe("");
   });
 
   it("shows format error and does not fetch when token has wrong format", async () => {