auth fixes - #928

…#924

- adds Options.HttpTimeout, plumbed through ApiClientConfig and
  ComponentsConfig to NewHttpClient.
- raises the default HTTP client timeout from 10s to 30s, since OIDC
  token-exchange round trips on slow controllers were exceeding 10s and
  surfacing as spurious failures that drove the SDK into re-auth retries.
- exposes DefaultHttpTimeout for callers that want the new default.

…ug. Fixes #925

- expands errorIndicatesControllerSwap to recognize HTTP timeouts,
  context cancellation, EOF / ErrUnexpectedEOF, 5xx responses (via
  runtime.ClientResponseStatus), and url.Error timeouts so the SDK
  rotates to a different controller endpoint on transient transport
  failures instead of hammering an unhealthy one.
- moves the errors.As targets (opError, urlError) from package-level
  vars into local declarations. errors.As mutates the target, so the
  shared instances were racing across concurrent callers.

- replaces the fixed expiresAt - 10s schedule with tokenRefreshTime, which
  picks a random point between 1/2 and 5/6 of the token's remaining
  lifetime. The earlier window leaves headroom for slow refreshes and the
  jitter avoids thundering-herd token exchanges across SDK clients.
- skips the periodic service-list refresh when a token refresh is due in
  under 15 seconds, so the service refresh doesn't race the expiring
  token into an unnecessary re-auth on a 401.
- tokenRefreshTime returns time.Now() when the remaining lifetime is too
  small to jitter against (avoids rand.Int63n(0)).

- after a failed Authenticate(), subsequent calls within the backoff
  window return the cached error without retrying. Prevents callers from
  hammering an unreachable controller.
- backoff doubles per failure with jitter, capped at AuthBackoffMax.
  Defaults: AuthBackoffInitial=5s, AuthBackoffMax=5m.
- separates the un-jittered base (authBackoff) from the per-failure
  wait (currentWait) so jitter doesn't compound into the doubling
  sequence.
- exposes Options.AuthBackoffInitial / AuthBackoffMax for embedders.

- a 401 on a service-related call within 15s of a successful api-session
  refresh is almost always a propagation race (server saw the request
  before processing the new token). Retry with the current session
  instead of going through Authenticate(), which would needlessly drive
  the refresh machinery and risk churning sessions and ER connections.
- converts lastSuccessfulApiSessionRefresh to concurrenz.AtomicValue so
  recentlyAuthenticated can read it without taking authAttemptLock; also
  records the refresh time after successful periodic refreshes in
  runRefreshes, not just on Authenticate-time refreshes.