This gives you:
• getToken() that:
• returns cached token if still valid
• otherwise calls your REST endpoint with the existing token
• Protection against the "thundering herd" of multiple callers triggering multiple renewals at once
• invalidate() method for logout or when you need to clear the token
• Support for seeding an initial token (e.g., from localStorage)
• No external deps, MIT-licensed, TypeScript-native