fix(auth): Log at warning level when a rate-limited token is expected to reset

[edgarrmondragon]

Summary

While digging into the CI rate-limit failures on #607, there was no signal in the logs for when a given token would become usable again once it hit its rate limit — just repeated RuntimeError: All GitHub tokens have hit their rate limit once every token in the pool was exhausted, with no indication of how long to wait or which token(s) were the blocker.

Changes

• TokenManager.has_calls_remaining() now logs a WARNING when it determines a token has hit its rate limit, including:
  • a masked, non-secret token identifier (last 4 characters, e.g. ...abcd)
  • the used/limit counts
  • the expected reset time (ISO 8601, UTC)
• The warning is deduped per reset window (only logs once until rate_limit_reset changes), so it won't spam on every has_calls_remaining() poll while waiting out the same window.
• AppTokenManager (GitHub App installation tokens) inherits this automatically via its super().has_calls_remaining() call.

Test plan

• tests/test_authenticator.py passes unchanged (44 passed)
• ruff check / ruff format --check pass
• Manually verified the log fires once with the expected fields and doesn't repeat on a second check within the same window:

  WARNING:tap_github.authenticator:Token ...abcd has hit its rate limit (4500/5000 used). Expected to reset at 2026-09-01T18:30:04.509913+00:00.