auth: resolve cluster context once per mirror wait, not per re-mint

RepoScopedToken re-ran cluster discovery and context selection on every call, so each 401-driven re-mint during a long clone wait depended on discovery staying reachable — a transient outage or cache problem mid-wait could abort a wait that had already authorized.

Split the two phases: RepoTokenSource resolves the cluster's core and login context once at construction and exposes Token/Invalidate over a repocreds cache, so re-mints only re-exchange (refreshing the login JWT if needed). waitForMirrorClone builds one source up front and invalidates before re-minting on 401; RepoScopedToken stays as the one-shot wrapper for single probes.