## Summary
- Fix stale-read race condition in `handleSupabaseOAuthReturn` and
`refreshSupabaseTokenForOrganization` where settings are read before an
async network call, then written back using the stale snapshot —
silently overwriting any concurrent credential writes from other orgs
- Fix legacy `refreshSupabaseToken` to preserve the `organizations` map
by spreading existing supabase settings before writing

## Test plan
- Verify connecting multiple Supabase organizations no longer causes
previously-connected orgs to lose their credentials
- Verify token refresh for one org does not clobber another org's
credentials
- All existing unit tests pass (842/842)

🤖 Generated with [Claude Code](https://claude.com/claude-code)
<!-- devin-review-badge-begin -->

---

<a href="https://app.devin.ai/review/dyad-sh/dyad/pull/2821"
target="_blank">
  <picture>
<source media="(prefers-color-scheme: dark)"
srcset="https://static.devin.ai/assets/gh-open-in-devin-review-dark.svg?v=1">
<img
src="https://static.devin.ai/assets/gh-open-in-devin-review-light.svg?v=1"
alt="Open with Devin">
  </picture>
</a>
<!-- devin-review-badge-end -->

---------
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>