fix(server): harden auth upstream connection handling

[abhinav-galileo]

Summary

• set auth upstream HTTP keepalive expiry to avoid reusing stale idle sockets while preserving HTTPX's default connection-count capacity
• expose generic auth upstream HTTP pool tuning env vars for keepalive expiry and connection limits
• add low-cardinality Prometheus metrics for auth upstream attempts and latency
• cover connection tuning validation and single-attempt network error behavior in auth framework tests

Non-goals

• no retry logic
• no caching
• no API changes
• no deployment-specific behavior

Tests

• uv run --package agent-control-server pytest -q --noconftest server/tests/test_auth_framework.py -k http_upstream
• uv run --package agent-control-server ruff check --config pyproject.toml server/src/agent_control_server/auth_framework/providers/http_upstream.py server/src/agent_control_server/auth_framework/config.py server/tests/test_auth_framework.py
• uv run --package agent-control-server mypy --config-file pyproject.toml server/src/agent_control_server/auth_framework/providers/http_upstream.py server/src/agent_control_server/auth_framework/config.py

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[galileo-automation]

🎉 This PR is included in version 3.0.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀