feat(auth): add request deduplication for concurrent session operations

[venkat2295]

feat(auth): add request deduplication for concurrent session operations

🔍 Description

This PR implements request deduplication to prevent redundant concurrent network requests during authentication operations, specifically for session fetching and recovery operations.

What changed?

• Added getSessionDeferred property to deduplicate concurrent getSession() calls
• Added recoveringDeferred property to deduplicate concurrent _recoverAndRefresh() operations during initialization
• Implemented deferred promise pattern to ensure multiple concurrent calls share the same underlying network request
• Created test file test-concurrent-requests.ts to verify deduplication behavior

##Key Implementation Details:

• When multiple getSession() calls are made concurrently, only the first call triggers a network request
• Subsequent concurrent calls wait for and receive the result from the first request
• The same pattern is applied to _recoverAndRefresh() to prevent redundant session recovery during client initialization
• Uses the existing Deferred utility class for promise coordination

Why was this change needed?

Problem:
When multiple parts of an application call getSession() simultaneously (e.g., during app initialization, route guards, or component mounting), each call would trigger a separate network request to the auth server. This leads to:

• Unnecessary network traffic and increased latency
• Higher backend load and infrastructure costs
• Potential race conditions in session state management
• Poor user experience due to redundant API calls

Solution:
By implementing request deduplication, we ensure that concurrent calls to the same operation share a single network request, significantly reducing overhead while maintaining the same API behavior.

Closes #1966

📸 Screenshots/Examples

Test Output

The test-concurrent-requests.ts file demonstrates the improvement:

// 10 concurrent getSession() calls
const promises = Array.from({ length: 10 }, () => 
  supabase.auth.getSession()
)
const results = await Promise.all(promises)
// ✅ Only 1 network request is made (instead of 10)
// ✅ All calls return identical results

## 🔄 Breaking changes

<!-- If this PR contains breaking changes, describe them here -->

- [x] This PR contains no breaking changes

Note: This is a purely internal optimization. The public API remains unchanged, and all existing code will continue to work exactly as before.

## 📋 Checklist

<!-- Ensure all items are checked before submitting -->

- [x] I have read the [Contributing Guidelines](https://github.com/supabase/supabase-js/blob/master/CONTRIBUTING.md)
- [x] My PR title follows the [conventional commit format](https://www.conventionalcommits.org/): `<type>(<scope>): <description>`
- [x] I have run `npx nx format` to ensure consistent code formatting
- [x] I have added tests for new functionality (if applicable)
- [ ] I have updated documentation (if applicable)

## 📝 Additional notes

Performance Impact:
- Reduced network requests: In scenarios with 10 concurrent calls, this reduces      requests from 10 to 1 (90% reduction)
- Improved latency: Eliminates redundant round-trips to the auth server
- Lower backend load: Significantly reduces load on Supabase Auth infrastructure

## Testing
The test-concurrent-requests.ts file can be used to verify the deduplication behavior. It demonstrates that multiple concurrent getSession() calls result in only a single network request.

## Future Considerations
This pattern could potentially be extended to other auth operations like 
refreshSession() if similar concurrent request patterns are identified.



<!-- Thank you for contributing to Supabase! 💚 -->