Address review: userinfo, default ports, and the helper fallback

Three findings from Bugbot on the previous commit, all confirmed.

Credentials in the URL's userinfo were not bound to the endpoint's site. outgoingAuth gates c.Auth, but requests are built from requestURL().String(), and the resolved endpoint was a copy of EndpointURL with only scheme and host replaced — userinfo came along. net/http derives Basic auth from req.URL.User, so a cross-site redirect authenticated against the redirect host with no Authorization header of ours involved: outgoingAuth never saw it, so there was not even a warning. Reproduced against httptest servers, where "user:URLSECRET" reached the redirect target, and confirmed against the built binary. Resolved endpoints now drop userinfo when they leave the site, and warn when they do. This also makes the docs' claim that userinfo is bound like a flag token true rather than aspirational.

sameSite compared ports literally, so "https://host" and "https://host:443" read as different sites. Proxies and load balancers do spell the default port out in a Location header, and treating that as cross-site would withhold credentials from a genuinely same-origin replica — a false negative that breaks working setups rather than leaking anything. Default ports are now normalized per scheme, with the default port for the other scheme still counting as a real port.

The withheld-credentials warning promised a credential-helper lookup that could not happen: syncer.newConn installed the helper only when no explicit auth was configured, which is exactly the case where the token is now withheld. So a --source-token user hitting a cross-site redirect got a bare 401 and the documented remedy did not work. The helper is now installed alongside an explicit token — for same-site requests the token still wins, so the helper is only consulted where the token is deliberately not sent — and the warning names the real next step either way.