cli/auth: make the two-tier mint locking contract explicit in comments

Review nit on #1641: CellClientFactory.mu's comment said "never held across I/O" while mintSlot.mu is deliberately held across the exchange (that's the single-flight). Say both halves explicitly so neither comment reads as contradicting the other. Comment-only change.