refactor(sync): centralize with_token in oauth.lua with shared lock

Problem: `with_token` was duplicated in `gcal.lua` and `gtasks.lua`,
with the concurrency lock added only to the gtasks copy. Any new
backend would silently inherit the same race, and gcal back-to-back
push could still create duplicate remote calendar events.

Solution: lift `with_token` into `oauth.lua` as
`M.with_token(client, name, callback)` behind a module-level
`_sync_in_flight` guard. All backends share one implementation; the
lock covers gcal, gtasks, and any future backend automatically.

lua/pending/sync/oauth.lua

@@ -26,6 +26,7 @@ local OAuthClient = {}
 OAuthClient.__index = OAuthClient
 
 local _active_close = nil
+local _sync_in_flight = false
 
 ---@class pending.oauth
 local M = {}
@@ -51,6 +52,30 @@ function M.async(fn)
   coroutine.resume(coroutine.create(fn))
 end
 
+---@param client pending.OAuthClient
+---@param name string
+---@param callback fun(access_token: string): nil
+function M.with_token(client, name, callback)
+  if _sync_in_flight then
+    require('pending.log').warn(name .. ': sync operation in progress — please wait')
+    return
+  end
+  _sync_in_flight = true
+  M.async(function()
+    local token = client:get_access_token()
+    if not token then
+      _sync_in_flight = false
+      require('pending.log').warn(name .. ': not authenticated — run :Pending auth')
+      return
+    end
+    local ok, err = pcall(callback, token)
+    _sync_in_flight = false
+    if not ok then
+      require('pending.log').error(name .. ': ' .. tostring(err))
+    end
+  end)
+end
+
 ---@param str string
 ---@return string
 function M.url_encode(str)