fix(auth): stop retries after credential or security rejection

[Pigbibi]

Summary

• Stop credential/security/2FA refusals without switching routes or resubmitting credentials.
• Allow at most one existing fallback only for known initial connection-establishment failures before credential entry; unknown/reset/timeout/token-exchange errors cannot retry authentication.
• Remove repeated navigation and rejected 2FA resubmission; retain normal successful first attempts.
• Limit risk-banner matching to explicit rejection language, not ordinary investment-risk disclosures.
• Add the offline synthetic caller regression to existing Node 20 CI.

Validation

• RED reproduced two logins after locked/post-submit errors and two rejected 2FA submissions; legitimate risk disclosures also reproduced false rejection.
• GREEN: auth classification and real-caller VM counters, auth-code extraction, proxy configuration, workflow static checks, syntax and diff checks passed locally; independently reproduced by parent reviewer.
• Strict fake module loader, empty inherited environment, no actual browser/cloud/OTP modules or network/secret/screenshot operations.

Release hold — do not merge

Publication is authorized for PR and required Node 20 CI only. Main is consumed by the ACTIVE scheduled Schwab Token Auto Refresher workflow, which performs real authentication and secret writes. Merge/auto-merge/dispatch/schedule changes are NOT authorized for this task. Retain this PR pending explicit runtime-adoption release authority. No actual login, OTP, refresh, deployment, or credential access occurred.