fix(auth): preserve session affinity across priorities

Keep a healthy cached session binding even when a higher-priority credential recovers. Continue applying credential priority to cold selection, plugin scheduling, and true failover.

Resolve the across-priority candidate list in a single availability pass and narrow the highest-priority tier from the same cloned auths, so the selection path does not scan or deep-clone candidates twice. Document that an established binding outranks credential priority.

Fixes #4808