Auth: move token-fetch handling into its own file

What does this MR do and why?

Mostly a move: the token-fetch error type, its labels, fetchAccessToken, the failure handler and the metric recording move from auth.go to token_fetch.go, and scopeToProjectPrefix to session.go. The next MRs add enough to this code that it deserves its own file.

Two small behaviour changes on the token request itself:

• it declares Content-Type: application/x-www-form-urlencoded, which RFC 6749 requires and whose absence Rack had been tolerating;
• its transport propagates the correlation ID, as the internal API client already does, so a token-fetch failure in Pages' logs can be joined to the Rails request that produced it.

Both are covered by unit tests.

Part of a stack replacing !1333 (closed) for #1190 (closed), on top of !1309 (closed):

1. stub contract mode (test-only)
2. move token-fetch handling into its own file
3. retry the exchange once in place
4. bounded restart with a recovery cookie
5. failure page at the requested page

Each MR targets the previous one's branch and retargets automatically when that merges.

How to validate

go test ./internal/auth/ and make acceptance ARGS='-run TestTokenFetchFailure'.

🤖 Generated with Claude Code