Harden automatic SSO renewal - #407

Summary

• schedule SSO refresh from JWT expiry with clock-skew leeway and retry throttling
• centralize renewal outcomes, refresh-token rotation recovery, and safe keyring persistence
• preserve usable SSO tokens after transient failures while allowing rejected or expired sessions to fall through to other credential providers
• skip automatic renewal for authentication commands and emit precise stderr warnings without bypassing normal API error rendering

Validation

• pytest -q cloudsmith_cli/core/tests/test_sso.py cloudsmith_cli/core/tests/test_keyring.py cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/cli/tests/test_decorators.py
• pre-commit run --files CHANGELOG.md cloudsmith_cli/cli/decorators.py cloudsmith_cli/cli/tests/test_decorators.py cloudsmith_cli/core/credentials/models.py cloudsmith_cli/core/credentials/providers/keyring_provider.py cloudsmith_cli/core/keyring.py cloudsmith_cli/core/sso.py cloudsmith_cli/core/tests/test_keyring.py cloudsmith_cli/core/tests/test_keyring_provider.py cloudsmith_cli/core/tests/test_sso.py

Stacked on #406.