fix: report a refused token when the anonymous size lookup fails too

A 401/403 on the authenticated GitHub size lookup was replaced by the anonymous retry's answer, so SSO enforcement or an exhausted rate limit on a private repository surfaced as a plain 404. Keep the refusal and report it in the log (refused_auth_error) and in the notice.

Also:

• treat a reported size of 0 as an answer: one-shot at INFO, no notice
• send a token written as the URL username alone, as net/http does
• note in sameSite's doc that EndpointAuth hands helper credentials to a sibling service on the endpoint's site