fix: refresh JWT before rate-limit retries

Summary

• Refresh the request JWT immediately before every retryable HTTP attempt.
• Keep the signer request-scoped through context.Context, without mutating the shared HTTP client.
• Add a deterministic regression test for the 429 rate-limit retry path.

Problem

Fixes #849. A Git-over-SSH internal API request can receive rate-limit responses long enough for the JWT created before the first attempt to expire. The eventual retry then returns an unrelated 401 instead of preserving the expected retry behavior.

Validation

• make compile && make validate
• go test -race -count=1 -run '^TestJWTHeaderRefreshesOnRateLimitRetry$' ./client
• go vet ./client

The commit is DCO signed-off.

AI assistance disclosure

AI assistance was used to help investigate and draft this focused fix. The contributor reviewed the resulting change and validation output, and the patch is limited to the reported retry-authentication behavior.