fix(client): harden HTTP retry and add 401-triggered token refresh

[tim-thacker-nullify]

Why

The HTTP plumbing the CLI and the long-running MCP server depend on had reliability gaps and zero test coverage.

What

retry.go

• Method-aware retries. 5xx is now retried only for idempotent methods (GET/HEAD/PUT/DELETE/OPTIONS/TRACE). A POST/PATCH that may have committed server-side before erroring is no longer blindly replayed — previously a duplicate-scan / duplicate-autofix hazard. 429 is still retried for any method (the server rejected it without processing).
• Honor Retry-After (seconds or HTTP-date), capped at maxDelay, instead of only client-side exponential backoff.
• Drain the response body before retrying so the connection can be reused; switch to math/rand/v2.

refreshing_transport.go

• React to 401. The cached token can go invalid before its 5-minute TTL (revocation, server session kill, clock skew); previously every request kept sending the dead token for up to 5 minutes. Now a 401 forces a refresh and retries once. The forced refresh is storm-safe (concurrent 401s collapse to a single refresh) and the request body is buffered so it replays correctly.

Tests — first coverage for internal/client: retry status/method gating, Retry-After parsing + cap, body replay, context cancellation, and the 401 refresh-and-retry / storm-safety / TTL paths.

Test plan

• go build ./... ✅, go vet ./... ✅, go test ./... ✅ (13 new tests in internal/client).

🤖 Generated with Claude Code