fix: reuse KIS tokens across concurrent requests

src/dotnet/QuantEngine.Infrastructure/Services/KisApiClient.cs

@@ -1,5 +1,7 @@
 using System;
 using System.Collections.Generic;
+using System.Collections.Concurrent;
+using System.Globalization;
 using System.Linq;
 using System.Net.Http;
 using System.Net.Http.Json;
@@ -29,6 +31,7 @@ public class KisApiClient : IKisApiClient
     private readonly HttpClient _httpClient;
     private readonly ITokenCache _tokenCache;
     private readonly ILogger<KisApiClient> _logger;
+    private static readonly ConcurrentDictionary<string, SemaphoreSlim> TokenLocks = new();
 
     public KisApiClient(HttpClient httpClient, ITokenCache tokenCache, ILogger<KisApiClient> logger)
     {
@@ -159,6 +162,12 @@ public class KisApiClient : IKisApiClient
 
     private async Task<string> GetOrRefreshTokenAsync(KisCredentials creds)
     {
+        var tokenLock = TokenLocks.GetOrAdd(creds.Account, _ => new SemaphoreSlim(1, 1));
+        await tokenLock.WaitAsync();
+        try
+        {
+            // Re-check after acquiring the account lock. Another request may
+            // have refreshed the shared cache while this request was waiting.
             var cachedToken = await _tokenCache.GetCachedTokenAsync(creds.Account);
             if (!string.IsNullOrEmpty(cachedToken))
                 return cachedToken;
@@ -183,10 +192,13 @@ public class KisApiClient : IKisApiClient
                 var expiresInStr = tokenData.TryGetValue("expires_in", out var expiresObj) && expiresObj != null
                     ? expiresObj.ToString()
                     : "86400";
-            var expiresInSec = int.TryParse(expiresInStr, out var seconds) ? seconds : 86400;
+                var expiresInSec = int.TryParse(expiresInStr, NumberStyles.Integer, CultureInfo.InvariantCulture, out var seconds)
+                    ? seconds
+                    : 86400;
                 var expiresAt = DateTime.UtcNow.AddSeconds(expiresInSec);
 
                 await _tokenCache.SaveTokenAsync(creds.Account, accessToken, expiresAt);
+                _logger.LogInformation("KIS token refreshed for {Account}; expires at {ExpiresAtUtc}", creds.Account, expiresAt);
                 return accessToken;
             }
             catch (Exception ex)
@@ -195,6 +207,11 @@ public class KisApiClient : IKisApiClient
                 throw new InvalidOperationException("KIS token refresh failed; check credentials and API availability.", ex);
             }
         }
+        finally
+        {
+            tokenLock.Release();
+        }
+    }
 
     private static void AssertReadOnly(string path, string trId)
     {

src/dotnet/QuantEngine.Infrastructure/Services/PostgresTokenCache.cs

@@ -1,4 +1,5 @@
 using System;
+using System.Globalization;
 using System.Threading.Tasks;
 using Dapper;
 using QuantEngine.Core.Interfaces;
@@ -31,7 +32,11 @@ namespace QuantEngine.Infrastructure.Services
             if (token == null)
                 return null;
 
-            var expiresAt = DateTime.Parse(token.ExpiresAt);
+            DateTime expiresAt;
+            if (!DateTime.TryParse((string)token.ExpiresAt, CultureInfo.InvariantCulture,
+                    DateTimeStyles.AssumeUniversal | DateTimeStyles.AdjustToUniversal,
+                    out expiresAt))
+                return null;
             var now = DateTime.UtcNow;
             var refreshSkew = TimeSpan.FromMinutes(TokenRefreshSkewMinutes);