Fix entiredb token-refresh: doc, caller context, and proxy

[Soph]

Problems

Three issues in the Entire DB token path (internal/auth/entiredb.go):

1. Doc comment was backwards. getTokenWithRefresh's comment claimed it "returns the stale token with a nil error rather than propagating the refresh error" — the opposite of what the code does (it surfaces the error, per issue Add ci and lint move to camelCase JSON #7). Corrected to match.
2. Refresh ignored the caller's context. It ran on context.Background(), so a cancelled sync (Ctrl-C) couldn't abort an in-flight token refresh until the 30s client timeout. Thread the caller's context: newConn → auth.Resolve → LookupEntireDBCredential → lookupEntireDBToken → getTokenWithRefresh.
3. Refresh bypassed the proxy. A bare &http.Transport{} leaves Proxy nil, so HTTP(S)_PROXY/NO_PROXY were ignored for the refresh request (unlike the default transport the git transport uses). Set Proxy: http.ProxyFromEnvironment.

Scope

auth.Resolve, LookupEntireDBCredential, lookupEntireDBToken, and newConn gain a leading ctx parameter; all in-module call sites (one production caller each, plus sha256convert's openSource which already has a ctx, and the test call sites) are updated. getTokenWithRefresh/refreshAccessToken already took ctx.

Tests

TestGetTokenWithRefreshHonorsContext stores an expired token + refresh token and a cancelled context, then asserts the refresh fails with an error wrapping context.Canceled — proving the context reaches the HTTP request. Full go test ./... passes.

🤖 Generated with Claude Code

---

Note

Medium Risk
Touches authentication and token refresh on the sync path; behavior changes (cancellation, proxy) are intentional but affect credential resolution in proxied or interrupted runs.

Overview
Fixes three issues on the Entire DB OAuth token path used when resolving HTTP auth.

Caller context is threaded from sync/convert-sha256 through newConn → auth.Resolve → LookupEntireDBCredential → getTokenWithRefresh, replacing context.Background() on refresh so a cancelled run (e.g. Ctrl-C) can abort in-flight refresh instead of waiting on the 30s HTTP client timeout.

The token refresh HTTP client now sets Proxy: http.ProxyFromEnvironment so HTTP(S)_PROXY / NO_PROXY match default git transport behavior (a bare &http.Transport{} skipped the proxy).

getTokenWithRefresh’s doc comment is corrected to state refresh failures are returned to the caller (issue #7), not silently returning a stale token.

Adds TestGetTokenWithRefreshHonorsContext to assert a pre-cancelled context yields context.Canceled from refresh.

^{Reviewed by Cursor Bugbot for commit 61ba091. Configure here.}

[Soph]

Superseded by #95, which removes the Entire DB credential-store integration entirely. mirror-pipeline (the only library consumer talking to entiredb) authenticates at the transport layer and never uses this path, and client-side entire:// auth is handled by git-remote-entire's contexts.json model — so the code this PR fixes has no live producer of the credentials it reads. Closing in favor of the removal.