Make GitHub token refresh threshold configurable

The hardcoded 300-second (5-minute) refresh threshold was causing the
github-token-refresh test to fail. With a 2-second token lifetime, fresh
tokens were immediately considered "expiring" (2s < 300s threshold),
triggering unnecessary refreshes on every getClient() call.

Changes:
- Add githubTokenRefreshThresholdSeconds to Settings (default: 300)
- Read TASKRUNNER_GITHUB_TOKEN_REFRESH_THRESHOLD_SECONDS env var
- Use configurable threshold in getClient and loadOrRefreshClient
- Set threshold to 1 second in github-token-refresh test

This allows the test to verify proper token refresh behavior:
- Fresh tokens (2s remaining >= 1s threshold) are reused
- Expired tokens trigger refresh
- Test now passes with 2 token requests instead of 4

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

Author: zyla

src/App.hs

@@ -63,6 +63,7 @@ getSettings = do
   primeCacheMode <- (==Just "1") <$> lookupEnv "TASKRUNNER_PRIME_CACHE_MODE"
   mainBranch <- map toText <$> lookupEnv "TASKRUNNER_MAIN_BRANCH"
   quietMode <- (==Just "1") <$> lookupEnv "TASKRUNNER_QUIET"
+  githubTokenRefreshThresholdSeconds <- maybe 300 read <$> lookupEnv "TASKRUNNER_GITHUB_TOKEN_REFRESH_THRESHOLD_SECONDS"
   pure Settings
         { stateDirectory
         , rootDirectory
@@ -78,6 +79,7 @@ getSettings = do
         , mainBranch
         , force = False
         , quietMode
+        , githubTokenRefreshThresholdSeconds
         }
 
 main :: IO ()

src/CommitStatus.hs

@@ -78,7 +78,8 @@ getClient appState = do
     Just client -> do
       -- Fast path: check if cached token is still valid
       now <- getCurrentTime
-      if diffUTCTime client.expiresAt now >= 300
+      let threshold = fromIntegral appState.settings.githubTokenRefreshThresholdSeconds
+      if diffUTCTime client.expiresAt now >= threshold
         then pure client
         else do
           -- Token expiring, need to refresh
@@ -92,6 +93,7 @@ loadOrRefreshClient :: AppState -> IO GithubClient
 loadOrRefreshClient appState = do
   let cacheFile = credentialsCacheFile appState.settings
   let lockFile = cacheFile <> ".lock"
+  let threshold = fromIntegral appState.settings.githubTokenRefreshThresholdSeconds
 
   client <- withFileLock lockFile Exclusive \_ -> do
     -- Under EXCLUSIVE lock: read, check, refresh if needed
@@ -100,7 +102,7 @@ loadOrRefreshClient appState = do
     now <- getCurrentTime
     case mCached of
       Just (cachedToken, expiresAt)
-        | diffUTCTime expiresAt now >= 300 -> do
+        | diffUTCTime expiresAt now >= threshold -> do
             -- Valid cached token
             logDebug appState "Using cached GitHub token from file"
             buildClientWithToken appState cachedToken expiresAt

src/Types.hs

@@ -21,6 +21,7 @@ data Settings = Settings
   , mainBranch :: Maybe Text
   , force :: Bool
   , quietMode :: Bool
+  , githubTokenRefreshThresholdSeconds :: Int
   } deriving (Show)
 
 type JobName = String

test/t/slow/github-token-refresh.txt

@@ -4,6 +4,7 @@
 # github token lifetime 2
 
 export TASKRUNNER_ENABLE_COMMIT_STATUS=1
+export TASKRUNNER_GITHUB_TOKEN_REFRESH_THRESHOLD_SECONDS=1
 
 git init -q
 git commit --allow-empty -q -m "Initial commit"