[kioku]

AIL authentication follows remote redirects and form actions while persisting session cookies and meter data. Those inputs were previously unbounded and not restricted to AIL destinations.

• Restrict requests, redirects, forms, and persisted cookies to approved HTTPS AIL hosts.
• Add request timeouts, response limits, and bounded meter-data validation.
• Recognize a remembered Keycloak session when it redirects directly to an authenticated Energy Buddy page.
• Treat provider and transport failures as retryable instead of rejected credentials; only an unsuccessful interactive login requests reauthentication.
• Close the client when Home Assistant setup fails and add authentication and security regression coverage.

Tests: pytest -q (41 passed); ruff check .; ruff format . --check.

[lukefx]

@kioku thx a lot for the contribution! Code looks good... some minor things regarding validations but we can improve it later :D