auth: bound per-profile validation with a 10s timeout

[janniklasrose]

Changes

Bound each per-profile validation in databricks auth profiles with a 10s timeout.

auth profiles validates every profile with a live API call (Workspaces.List for account configs, CurrentUser.Me for workspace configs). The SDK retries transient network failures — connection refused, connect/TLS timeout, retriable 5xx — for its default RetryTimeoutSeconds (~5 minutes). So a single unreachable-but-retriable workspace stalls the entire listing for minutes.

• Wrap each validation call in a context.WithTimeout(ctx, 10s).
• Set the same value on cfg.HTTPTimeoutSeconds / cfg.RetryTimeoutSeconds, because the host-metadata fetch in EnsureResolved runs on context.Background internally and so can't be reached by the validation call's context — without these it would still retry for ~5 minutes.

Hosts that fail DNS (e.g. a typo'd or reserved hostname) are not retriable and already fail fast; this only bounds the retriable cases.

Why

Users with a decommissioned, firewalled, or otherwise unresponsive workspace in ~/.databrickscfg see auth profiles hang for minutes on that one entry, blocking the whole list. Bounding each validation keeps the command responsive.

Tests

• TestProfileLoadTimesOutOnUnresponsiveHost (cmd/auth/profiles_test.go) — points a profile at an httptest server that hangs every request until the client cancels, and asserts Load returns bounded rather than retrying to the SDK default. The handler waits on the request context so server.Close doesn't block on a leaked connection. profileValidationTimeout is a var so the test shrinks it (kept ≥1s, since Load derives the SDK's integer-second budgets from it and a sub-second value floors to 0 = "use default").
• Full cmd/auth package and ./task lint-q pass.

This pull request and its description were written by Isaac, an AI coding agent.

[github-actions]

Approval status: pending

/cmd/auth/ - needs approval

Files: cmd/auth/profiles.go, cmd/auth/profiles_test.go
Suggested: @simonfaltum
Also eligible: @mihaimitrea-db, @tanmay-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

General files (require maintainer)

Files: .nextchanges/cli/auth-profiles-timeout.md
Based on git history:

• @simonfaltum -- recent work in cmd/auth/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @lennartkats-db) can approve all areas.
See OWNERS for ownership rules.}

[andrewnester]

Why 10 seconds? Other CLI limits seem to be 30 seconds, maybe we should stick to this?

[janniklasrose]

Actually, there's auth-specific precedent too: cmd/auth/login.go and libs/auth/arguments.go both use HTTPTimeoutSeconds: 5. I think 30 seconds might be quite slow for auth profiles so +1 on consistency but maybe use the existing 5s here?