Feature/maintenance updates

[adrian-y1]

Summary

Two middleware classes (Idempotency, AuthRefresh) existed in the codebase but were never registered on the Faraday connection, so the behavior the README documents — automatic request_id generation and retry-once-on-401 — never actually happened at runtime. This PR wires both in, fixes a crash bug found in the process, and cleans up a large amount of duplicated test setup along the way.

Fixes

• Idempotency and AuthRefresh middleware are now actually active. Both were fully implemented and tested in isolation, but neither was ever passed to conn.use in Client#connection — dead code with no effect on real requests. Now registered in the correct order (Idempotency before JSON body encoding so it sees a Hash; AuthRefresh closest to the adapter).
• Fixed a latent crash in AuthRefresh. Its 401-retry guard used env[:request][:auth_retry], but env[:request] is a Faraday::RequestOptions struct with a fixed set of members — :auth_retry isn't one of them, so the first real 401 response would have raised NoMethodError. Replaced with a self-contained method (no state needs to persist across calls, so no guard flag is needed at all).
• CI now triggers on main. Workflow was configured for push: branches: [master]; the repo's default branch is main, so direct pushes never ran CI (only PRs did, since pull_request: has no branch filter).
• Removed a no-op header deletion in Client#authenticate!. req.headers.delete("Authorization") was deleting a key from a hash that can never contain it — verified empirically that Faraday::Connection#build_request always starts each request from a fresh .dup of the connection's persistent default headers, which never include Authorization.

Changed

• Client#request no longer manually manages the Authorization header or calls ensure_authenticated! — both are now owned by the AuthRefresh middleware.
• Centralized the /api/v1/authentication/login path into Client::LOGIN_PATH, referenced from both client.rb and auth_refresh.rb instead of being duplicated as a string literal.
• Ran bundle update — patch/minor dependency bumps only (faraday, rubocop, webmock, etc.), no Gemfile changes required.

Test suite cleanup

The same login-stub before block (and often an identical let(:auth_response)) was copy-pasted into ~19 spec files, alongside 153 literal occurrences of the sandbox host URL. Centralized both into spec/support/airwallex_test_helpers.rb:

• BASE_URL / LOGIN_PATH constants (sourced from the real Airwallex::Configuration::SANDBOX_API_URL / Airwallex::Client::LOGIN_PATH, not re-hardcoded)
• A stub_login helper, auto-applied via a global config.before hook so individual specs no longer need to stub it themselves
• Net -183 lines across the spec suite

Added spec/airwallex/middleware/auth_refresh_spec.rb — there was previously zero test coverage for this middleware.

Testing

• bundle exec rake (rspec + rubocop): 286 examples, 0 failures, rubocop clean
• Verified both middleware fixes end-to-end against a real WebMock-stubbed HTTP flow (not just isolated unit mocks): confirmed request_id is now injected into POST bodies, and the 401 → re-authenticate → retry-once flow works
• Manually smoke-tested against the real Airwallex sandbox API (local_tests/smoke_test.rb, gitignored) across authenticate!, Balance.list, Rate.retrieve, and several list() calls — all passing

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}