Handle non-fatal httprc errors in JWKS registration

[danbarr]

Summary

ensureJWKSRegistered treats every Register error as fatal and leaves the registration flag unset for retry. But httprc returns ErrNotReady when the resource was successfully registered and only the first fetch hasn't completed; the resource is already in httprc's map, so every retry then fails with ErrResourceAlreadyExists. One slow or failed first JWKS fetch (a slow IdP, a network blip on the first authenticated request, or the client bypass fixed in #6220) permanently disabled token validation for the life of the process.

• Treat ErrNotReady as registered-but-pending: the validator proceeds and Lookup surfaces a not-ready key set until a background fetch succeeds, so transient first-fetch failures now self-heal.
• Treat ErrResourceAlreadyExists as already-registered. Besides being the escape hatch for the retry trap, this also covers OIDC re-discovery resolving to the same JWKS URL after the registration flag is reset.
• New tests cover both sentinels; each fails against the previous code with the exact error strings from the issue.

Fixes #6218

Type of change

• Bug fix (non-breaking change which fixes an issue)

Test plan

• Unit tests pass (pkg/auth/... with race detection; new tests verified to fail pre-fix)
• task lint passes

Does this introduce a user-facing change?

Transient failures fetching an external OIDC issuer's JWKS on first use no longer permanently disable token validation until restart; validation recovers once a background fetch succeeds.

Special notes for reviewers

Stacked on #6220, which fixed the trigger that surfaced this; this PR hardens the retry path against any first-fetch failure. Review only this layer's diff via the stacked PR view.

Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 72.50%. Comparing base (e7a995b) to head (e5fe29f).

Files with missing lines	Patch %	Lines
pkg/auth/token.go	90.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #6221      +/-   ##
==========================================
+ Coverage   72.47%   72.50%   +0.02%     
==========================================
  Files         739      739              
  Lines       76719    76728       +9     
==========================================
+ Hits        55600    55628      +28     
+ Misses      17152    17121      -31     
- Partials     3967     3979      +12     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.