fix(cli): no redirects on the management client, race-safe token refresh, verbose Basic-fallback note (review 2026-10-21 05/U1, 05/P1 L1/L2/L3/L4)

- CreateDefaultHttpClient sets AllowAutoRedirect=false so a 307/308 cannot re-POST the
  /auth/token credential form elsewhere.
- A forced re-exchange after a 401 carries the refused token; inside the gate it reuses
  a token another caller already re-exchanged instead of binding again. The BasicOnly
  switch is written under the same gate.
- SCADABRIDGE_VERBOSE=1 prints a stderr note when a fresh token is refused and the CLI
  falls back to Basic.
- debug stream's AccessTokenProvider retries the exchange once and documents the
  null-token degradation (the hub refuses, automatic reconnect retries).
- Tests: concurrent refusal reuses the peer refresh (2 exchanges, not 3); real-socket
  redirect is not followed.

src/ZB.MOM.WW.ScadaBridge.CLI/README.md

@@ -2690,6 +2690,7 @@ The CLI resolves `--username` / `--password` (or `SCADABRIDGE_USERNAME` / `SCADA
 - A server without bearer support — no `/auth/token`, a login-disabled deployment, or an older server whose token response lacks `management_bearer: true` — is used with HTTP Basic for the rest of the process (an LDAP bind per call, as before).
 - Bad credentials or a login-throttle lockout at the exchange are reported directly (exit 1) and not retried with Basic.
 - Set `SCADABRIDGE_AUTH_MODE=basic` to skip the exchange entirely.
+- Set `SCADABRIDGE_VERBOSE=1` to get a stderr note when the server refuses a freshly issued token and the CLI falls back to Basic (usually central nodes with different `JwtSigningKey` values).
 
 ## Issues & Missing Features