fix: serialize the admin login lookup so concurrent first calls send one request

src/aegis_gitea_mcp/auth.py

@@ -9,6 +9,7 @@ token to the :class:`~aegis_gitea_mcp.identity.Identity` a tool call runs as.
 
 from __future__ import annotations
 
+import asyncio
 import hashlib
 import hmac
 import time
@@ -103,6 +104,7 @@ class AdminIdentityResolver:
         self._executor = executor
         self._login: str | None = None
         self._retry_at = 0.0
+        self._lookup_lock = asyncio.Lock()
 
     async def resolve(self, access: AccessToken | None) -> Identity:
         """Return the admin identity, or raise for an access token of another kind."""
@@ -113,9 +115,12 @@ class AdminIdentityResolver:
             raise ToolError("admin-token mode needs GITEA_TOKEN, which is not configured")
         token = secret.get_secret_value()
         if self._login is None and time.monotonic() >= self._retry_at:
-            self._login = await self._lookup_login(token)
-            if self._login is None:
-                self._retry_at = time.monotonic() + _LOGIN_RETRY_SECONDS
+            # One lookup for concurrent first calls: later callers wait, then see the result.
+            async with self._lookup_lock:
+                if self._login is None and time.monotonic() >= self._retry_at:
+                    self._login = await self._lookup_login(token)
+                    if self._login is None:
+                        self._retry_at = time.monotonic() + _LOGIN_RETRY_SECONDS
         return Identity(login=self._login, mode="admin-token", token=token)
 
     async def _lookup_login(self, token: str) -> str | None: