Less tab storms through smarter failures

[VersusFacit]

Description

I made a finite state machine 🫠

I manually ran through the behaviors I changed and can report the mysterious (why are all these SAMLs continuously spamming even though my first auth failed / was cancelled) scenario is fast failing now.

External Browser Authentication Failure Scenarios

Scenario	Where it fails	Example cause	Behavior (driver)
SAML-phase failure (no token obtained)	During authenticateByExternalBrowser	Browser could not open, user canceled at IdP, mistyped password, timeout waiting for redirect	Retryable immediately. No backoff marker set.
Auth-phase failure (no cached ID token)	After SAML, during authenticate()	Snowflake rejects token: IP restriction (390422), account misconfiguration, IdP mismatch	Fail fast with backoff. Marker set for ~60s to fail all new connections and prevent tab storms.
Auth-phase failure (cached ID token)	Attempting with cached ID token	Cached ID token expired, corrupted, or revoked	Clear token and retry once interactively. If retry succeeds, clear marker. If retry fails, set backoff.
Auth-phase failure (OAuth refreshable)	After SAML or token use	Token expired but refreshable	Run refresh logic. Delete bad token, refresh, retry authenticate(). Underlying error surfaces if refresh fails.
Context canceled / deadline exceeded	Any point	Caller cancels Go context, timeout at client level	Fail fast, no backoff.
Success	All phases complete	Valid SAML, token accepted	Clear any stale backoff marker. Cache ID token if configured.

Manual tests using build in a dbt project

1. run project with empty token cache
2. run project with valid token cache
3. run project with invalidated-by-manual-corruption token cache
4. run project with valid token cache and corruption midexecution (see one browser pop up and then fixed)
5. run project with valid token cache and no vpn -- only one tab

[VersusFacit]

I'm actually thinking I might bump this back up to 30 since we want to fast fail all threads waiting to auth once the first failure is discovered and 10 seconds may not be enough...