feat: auto-recreate reviewer containers on token rotation

When OAuth tokens rotate or refresh, all reviewer containers are
automatically removed. The next reviewer turn recreates them with
the latest token, preventing 401 auth failures.

Uses callback pattern to avoid circular dependencies:
- token-rotation.ts: onTokenRotated(cb)
- token-refresh.ts: onTokenRefreshed(cb)
- index.ts: registers recreateAllReviewerContainers as callback

src/token-refresh.ts

@@ -317,9 +317,31 @@ async function checkAndRefreshAll(): Promise<void> {
 
   if (anyRefreshed) {
     updateEnvTokens();
+    if (onTokenRefreshedCallback) {
+      try {
+        onTokenRefreshedCallback();
+      } catch (err) {
+        logger.warn(
+          { err: getErrorMessage(err) },
+          'Post-token-refresh callback failed',
+        );
+      }
+    }
   }
 }
 
+// ── Post-refresh callback ───────────────────────────────────────
+// Allows callers (e.g. index.ts) to register a hook that runs after
+// any token is refreshed — used to recreate reviewer containers whose
+// persistent Claude Code SDK process still holds the old token.
+type TokenRefreshCallback = () => void;
+let onTokenRefreshedCallback: TokenRefreshCallback | null = null;
+
+/** Register a callback to be invoked after a successful token refresh. */
+export function onTokenRefreshed(cb: TokenRefreshCallback): void {
+  onTokenRefreshedCallback = cb;
+}
+
 let refreshInterval: ReturnType<typeof setInterval> | null = null;
 
 export function startTokenRefreshLoop(): void {
@@ -381,6 +403,16 @@ export async function forceRefreshToken(
     if (tokenIndex < allTokens.length) {
       updateTokenValue(tokenIndex, newAccessToken);
       updateEnvTokens();
+      if (onTokenRefreshedCallback) {
+        try {
+          onTokenRefreshedCallback();
+        } catch (err) {
+          logger.warn(
+            { err: getErrorMessage(err) },
+            'Post-token-refresh callback failed (force refresh)',
+          );
+        }
+      }
     }
   }
   return newAccessToken;