refactor(auth): split writer serialization from reader lock in replaceFileUsers

Add buildMu to serialize replaceFileUsers's writer body (including
buildEntry's potentially slow file-backed resolveSecret reads for
"file:"-prefixed API keys). Scope mu.Lock() to the final byDigest
swap only, so a rebuild in progress no longer stalls every identify
call for its whole duration. Behavior-preserving: writers stay fully
serialized, same as before.

Adds a regression test that holds buildMu externally and asserts
identify still succeeds — proving identify's read path does not
depend on the writer-serialization lock.

auth_test.go

@@ -5,6 +5,7 @@ import (
 	"net/http/httptest"
 	"sync"
 	"testing"
+	"time"
 )
 
 // TestIdentify is the brief's Step-1 table: bearer auth resolves the right
@@ -374,3 +375,38 @@ func TestAuthStore_ReplaceFileUsers_ConcurrentWritersAndReaders(t *testing.T) {
 		t.Fatalf("want exactly one file-user batch to survive concurrent swaps (size %d), got size %d — a rebuild was lost or merged with another", want, got)
 	}
 }
+
+// TestAuthStore_Identify_NotBlockedByBuildMu is the regression for the
+// Task-4 lock split: replaceFileUsers's writer-serialization lock (buildMu)
+// must be independent from the reader lock (mu) that identify uses. The
+// prior implementation held mu for the whole rebuild, which would stall
+// every identify call for as long as a reload's build phase (including
+// resolveSecret's potentially slow file-backed reads) took. Holding buildMu
+// externally here simulates "a rebuild's build phase is in progress" — a
+// correct identify must not need buildMu at all.
+func TestAuthStore_Identify_NotBlockedByBuildMu(t *testing.T) {
+	a, err := newAuthStore(testAuthCfg())
+	if err != nil {
+		t.Fatal(err)
+	}
+	a.buildMu.Lock()
+	defer a.buildMu.Unlock()
+
+	r := httptest.NewRequest("POST", "/v1/chat/completions", nil)
+	r.Header.Set("Authorization", "Bearer sk-secret")
+
+	done := make(chan bool, 1)
+	go func() {
+		_, _, ok := a.identify(r)
+		done <- ok
+	}()
+
+	select {
+	case ok := <-done:
+		if !ok {
+			t.Fatal("want identify to succeed")
+		}
+	case <-time.After(2 * time.Second):
+		t.Fatal("identify blocked while buildMu is held — reader lock must not depend on the writer-serialization lock")
+	}
+}