fix: restore CAS lck retry to 3x with 60s timeouts

A prior 'docs: update readme' commit (e3c2bde) silently regressed the
CAS-lck extraction loop — reduced attempts from 3 to 2, timeouts from
60s to 15s/10s, and dropped the per-retry print. That undid the fix
in dae2514 and caused 'Failed to extract lck from CAS redirect chain'
on every Actions run. Restoring the original retry shape and bumping
the inter-attempt sleep to 3s. The /login early-exit (skipping the
heavy login page when WebVPN bounces us back) is kept — it just makes
the failed inner pass exit faster so the next outer attempt can run.

Author: LeafCreeper

src/api/webvpn.py

@@ -199,20 +199,25 @@ def authenticate_icourse(
         vpn_url = get_vpn_url(casapi_url)
 
         # Follow redirect chain to reach IDP login page and extract lck.
-        # One fast retry handles transient CAS 200 responses; if it still
-        # fails, let login_with_retry() do a full WebVPN re-login instead.
+        # The CAS gateway intermittently returns a 200 interstitial or
+        # bounces back to WebVPN's own /login (cookie not yet effective
+        # for the casapi vhost) right after a successful WebVPN login.
+        # Retry a few times in-place before letting login_with_retry()
+        # waste a full WebVPN re-login on a transient hiccup.
         import time as _time
         lck = None
-        for cas_attempt in range(2):
+        for cas_attempt in range(3):
             if cas_attempt > 0:
-                _time.sleep(2)
-            resp = self.session.get(vpn_url, allow_redirects=False, timeout=15)
+                print(f"    CAS lck extract retry {cas_attempt}/2...")
+                _time.sleep(3)
+            resp = self.session.get(vpn_url, allow_redirects=False, timeout=60)
             for _ in range(15):
                 location = resp.headers.get("Location", "")
                 if resp.status_code not in (301, 302, 303, 307) or not location:
                     break
-                # WebVPN returning /login means the session is stale —
-                # don't waste time fetching the heavy login page.
+                # WebVPN bouncing to its own /login means the session
+                # isn't recognised for this vhost — stop chasing the
+                # heavy login page and let the outer retry try again.
                 if "/login" in location:
                     break
                 lck_match = re.search(r'lck=([^&#"]+)', location)
@@ -222,7 +227,7 @@ def authenticate_icourse(
                 if not location.startswith("http"):
                     location = urljoin(resp.url, location)
                 resp = self.session.get(
-                    location, allow_redirects=False, timeout=10
+                    location, allow_redirects=False, timeout=60
                 )
             if lck:
                 break