Authenticated fetch, redirects, retries, and response caching

createAuthenticatedFetch adds auth, tracing, a 30-second default timeout, up to two retries, and 401 refresh. Preserve the initial fetch shape and clone or snapshot replay state without materializing FormData or consuming streams. Redirect method conversion must not overwrite the original headers/body used by outer retries; same-origin 307/308 redirects must replay request bodies, and FormData boundaries must survive. When a caller supplies a Request without init, retain input.headers. The RFC 7234 GET-2xx cache uses stable/volatile/immutable TTLs of 5 minutes/60 seconds/24 hours. Tests must isolate auth/config and reset or disable both fetch and cache state because cache lookup precedes mocked fetch.