fix: isolate in-memory client persistence

client.go

@@ -61,6 +61,7 @@ func WithQRWriter(writer io.Writer) Option {
 
 type Client struct {
 	authPath        string
+	deviceCacheDir  string
 	authDataChanged func(AuthData) error
 	authMu          sync.RWMutex
 	authData        AuthData
@@ -89,6 +90,7 @@ func NewClient(authPath string, options ...Option) (*Client, error) {
 		return nil, err
 	}
 	client.authPath = resolvedPath
+	client.deviceCacheDir = filepath.Dir(resolvedPath)
 	if err := client.loadAuthData(); err != nil {
 		return nil, err
 	}
@@ -135,10 +137,10 @@ func newClient(options ...ClientOption) (*Client, error) {
 }
 
 // WithAuthDataChanged configures synchronous persistence for in-memory auth updates.
-// The callback is serialized by the client's login lock and may acquire unrelated
-// application locks, but it must not call Client methods other than AuthData.
-// In particular, calling Login or another method that may refresh authentication
-// will deadlock. Returning an error leaves the client's authentication unchanged.
+// The callback runs under the client's internal login serialization. It must not
+// call Client methods other than AuthData or acquire a lock that may be held by any
+// goroutine calling Client. Callers must not call Client while holding a lock that
+// the callback may acquire. Returning an error leaves authentication unchanged.
 func WithAuthDataChanged(callback func(AuthData) error) ClientOption {
 	return func(client *Client) error {
 		if callback == nil {