feat: Add jitter and random offset to token refresh intervals for better distribution

internal/auth/request.go

@@ -5,6 +5,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"errors"
+	"math/rand"
 	"net/http"
 	"strings"
 	"sync"
@@ -329,16 +330,28 @@ func (r *Resolver) shouldForceRefresh(accountID string) bool {
 		r.tokenRefreshedAt[accountID] = now
 		return false
 	}
-	return now.Sub(last) >= time.Duration(intervalHours)*time.Hour
+	// Add jitter: ±15% random variation to avoid all accounts refreshing at the same time.
+	// For a 6h interval, this gives a range of ~5h06m to ~6h54m.
+	baseInterval := time.Duration(intervalHours) * time.Hour
+	jitterRange := baseInterval / 10 // ±10% → total range is 80%-120% of base
+	jitter := time.Duration(rand.Int63n(int64(2*jitterRange+1))) - jitterRange
+	effectiveInterval := baseInterval + jitter
+	if effectiveInterval < time.Hour {
+		effectiveInterval = time.Hour
+	}
+	return now.Sub(last) >= effectiveInterval
 }
 
 func (r *Resolver) markTokenRefreshedNow(accountID string) {
 	if strings.TrimSpace(accountID) == "" {
 		return
 	}
+	// Add a random offset (0-30min) to spread out future refreshes across accounts.
+	// This prevents all accounts from refreshing at the same wall-clock time.
+	offset := time.Duration(rand.Int63n(int64(30*time.Minute)))
 	r.mu.Lock()
 	defer r.mu.Unlock()
-	r.tokenRefreshedAt[accountID] = time.Now()
+	r.tokenRefreshedAt[accountID] = time.Now().Add(-offset)
 }
 
 func (r *Resolver) clearTokenRefreshMark(accountID string) {