auth: route RepoScopedToken through cluster discovery (COR-395)

RepoScopedToken minted repo-scoped tokens by exchanging the active context's login JWT at the hard-coded api.AuthBaseURL() core, never asking which core the target cluster trusts. Multi-core this ships the token to the wrong core's STS (exchange fails, or worse authenticates the wrong identity); the same gap COR-389, PR #1377, and git-remote-entire each fixed for their surface.

Resolve the login context the way git-remote-entire does — the cluster's /.well-known/entire-cluster.json names its trusted core(s), clusterdiscovery picks the eligible local context (active if eligible, sole, or explicit-choice error) — then exchange through repocreds with a refreshing login provider. This also closes the documented stale login-JWT gap (expired JWTs now re-mint from the refresh token) and makes the wire form exactly what git-remote-entire sends, client_id via Basic auth included.

httputil.OAuthError gains a Code field (RFC 6749 error, parsed best-effort) so the suspended-mirror sentinel ErrRepoTargetUnknown keeps working over the repocreds path.

The second COR-395 item, deleting resolveAuthHostToken, was already done; this removes the last stale comment reference.