Improve Seqera API preflight errors

[FloWuenne]

PR checklist

• This comment contains a description of changes (with reason).
• If you've fixed a bug or added code that should be tested, add tests!
• If you've added a new tool, parameter, or workflow path, update the relevant docs.
• If plugin declarations changed, update CITATIONS.md, README.md, and agent/context guidance in the same PR.
• Ensure the test suite passes (nextflow run . -profile test,docker --outdir <OUTDIR>).
• Check for unexpected warnings in debug mode (nextflow run . -profile debug,test,docker --outdir <OUTDIR>).
• CHANGELOG.md is updated.
• README.md is updated (including new tool citations and authors/contributors).

Description

Issue #72 is still reproducible on current main: an invalid token currently retries /orgs and fails with a generic API request failed ... HTTP 401 message.

This change adds a shared API preflight step before workspace resolution:

• validate the configured endpoint with GET /service-info
• validate auth with GET /user-info
• emit specific guidance for invalid endpoints, auth failures, and network/TLS failures
• cache successful validations per endpoint/token so repeated run fetches do not recheck unnecessarily

It also aligns the standalone Python fetch helper with the same behavior, adds focused regression tests, and updates the docs/context describing the API path and known failure modes.

Testing

• uv run --with typer --with pyyaml --with jinja2 --with pyarrow --with pytest --with httpx pytest -v modules/local/aggregate_benchmark_report_data/tests/test_aggregate.py modules/local/normalize_benchmark_jsonl/tests/test_normalize.py modules/local/render_benchmark_report/tests/test_render.py bin/test_benchmark_report_fetch.py
• nf-test test --profile=+docker --verbose
• nextflow run . --input workflows/nf_aggregate/assets/test_benchmark.csv --generate_benchmark_report --outdir /tmp/nf-aggregate-e2e-results -profile docker
• pre-commit run --all-files
• TOWER_ACCESS_TOKEN=bad-token nextflow run . --input /tmp/issue72_run_ids.csv --generate_benchmark_report --seqera_api_endpoint http://127.0.0.1:8765 --outdir /tmp/issue72-bad-token -ansi-log false
• TOWER_ACCESS_TOKEN=good-token nextflow run . --input /tmp/issue72_run_ids.csv --generate_benchmark_report --seqera_api_endpoint http://127.0.0.1:9999 --outdir /tmp/issue72-bad-endpoint -ansi-log false

The two issue-specific runs confirm the pipeline now fails at /user-info for bad tokens and /service-info for bad endpoints, instead of surfacing a generic /orgs failure.

  

[edmundmiller]

found one correctness issue in the new preflight cache. i also left one non-blocking note here: the groovy preflight path would be worth covering with an nf-test or integration regression so this behavior stays locked in.

[edmundmiller]

using token.hashCode() here can collide across distinct strings, so a different bearer token could incorrectly skip /user-info preflight in the same JVM. consider caching on the full token or a collision-resistant digest instead.

[edmundmiller]

fixed in 266688c. this now keys the cache on a sha-256 digest of the token instead of token.hashCode(), so distinct tokens cannot collide and skip preflight.