#3635 Stop counting an interactive OAuth login against request timeouts

Fixes #3601

A request's timeout was also counting the time a person spends in the browser during an interactive OAuth login. For the server/discover probe that Client(mode="auto") sends on connect, a login longer than its 10 seconds looked like a legacy server, so the client settled on 2025-11-25 against a server that speaks 2026-07-28.

The timeout now stops counting while OAuthClientProvider waits on redirect_handler and callback_handler, and picks up again with whatever was left. The probe keeps its 10 seconds, and a server that never answers is handled as before.

This is kept deliberately small. The clock lives in a private module and isn't public API. Where a request's timeout lives is likely to move as the client transport and dispatcher work (#3517) takes shape, and this will be looked at again alongside it.

Worth knowing:

• A request timeout no longer ends a login nobody finishes. That takes a limit inside callback_handler, or cancelling the caller.
• Only OAuthClientProvider is covered. A custom httpx2.Auth, like the one in the issue's example script, is still counted.

The tests run the real provider on a virtual clock: a login that outlasts the 10 seconds negotiates 2026-07-28, and a silent server still falls back at 10 seconds.

_{AI Disclaimer}