Delay --progress ticker until after auth resolution

internal/auth/auth.go shells out to 'git credential fill' when no explicit token is configured. That subprocess inherits our stderr via cmd.Output(), so its 'Username for ...:' prompt lands directly on the user's terminal — and the progress ticker, also writing to stderr with '\r' redraws, was clobbering the prompt mid-character.

Move the ticker start to the very end of newSession so it only spins up once both newConn calls (and therefore all credential prompts) have completed. As a bonus, this also closes a small goroutine leak: if newSession failed after starting the ticker, the caller had no session to defer finish() on.