core: carry credentials through the probe and its auth handshake

libcurl with CURLAUTH_ANY answers a 401/407 by resending the request with
an Authorization header. Two spots in net/ cut that short:

- http_client's header callback delivered the response head exactly once
  and latched `head_delivered`, so after an auth challenge the caller only
  ever saw the 401 — never the 2xx of the authenticated resend. Reset the
  latch when a fresh status line follows a delivered 401/407 (redirects
  never reach that path — their head is suppressed).

- the prober's head callbacks return DataAction::abort to skip the body,
  which also aborts the transfer mid-handshake. Return `proceed` for a
  401/407 when credentials were supplied, so curl's resend can run; the
  real status lands on the next header block.

Also give ProbeRequest an `auth` field (default scheme == none) and pass
it through base_request(), so a re-probe after a 401 can present the
credentials the user just entered. No behaviour change when no auth is
configured.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
Claude-Session: https://claude.ai/code/session_01HPPSGhiArbvQgwC2DNiURS

core/src/net/http_client.cpp

@@ -195,6 +195,13 @@ struct HttpClient::Impl {
         std::string_view line(buf, total);
 
         if (line.starts_with("HTTP/")) {
+            // A new status line after we already delivered a 401/407 means libcurl's
+            // CURLAUTH_ANY handshake just resent with credentials: let the head of this
+            // second response be delivered too, so callers see the real (2xx/4xx) status
+            // rather than the challenge. Redirects never reach here delivered — their head
+            // is suppressed below — so this only fires for the auth resend.
+            if (st->head_delivered && (st->line_status == 401 || st->line_status == 407))
+                st->head_delivered = false;
             st->line_status = status_from_line(line);
             st->head.headers.clear();  // keep only the final response's headers
             return total;