Add Account constructors backed by oauth2.TokenSource

[a2105z]

Description

Fixes #29.

Problem

account.New(oauthToken string, ...) stores a static Authorization bearer. When the access token expires, every Fleet API call from that Account fails until the application throws the Account away and constructs a new one. That is a blocker for long-running services (as called out on the issue): there is no way to keep a long-lived Account that refreshes credentials.

Stale PR #151 attempted this by making New take a TokenSource (breaking) and by assigning http.DefaultClient.Transport = oauth2.Transport{...}, which mutates the process-wide default client. This PR is a fresh, non-breaking implementation that avoids that.

Solution

• Add account.FromTokenSource(ts oauth2.TokenSource, userAgent string) for refreshing credentials
• Add account.FromToken(tok *oauth2.Token, userAgent string) convenience wrapper
• Keep account.New(string, ...) unchanged for existing callers / the HTTP proxy
• Resolve the Authorization header on each Account Fleet API request via the token source (wrapped with oauth2.ReuseTokenSource)
• Add inet.Connection.SetAuthHeaderFunc so GetVehicle connections also fetch a current token per request (a header baked in at GetVehicle time would go stale)
• Auth header callback failures are non-temporary so wake/retry loops do not spin on bad credentials

Example for a long-lived app:

ts := oauth2.ReuseTokenSource(tok, conf.TokenSource(ctx, tok))
acct, err := account.FromTokenSource(ts, "my-app")

@sethterashima @patrickdemers6 @agbpatro — please review. This unblocks long-lived Account usage without breaking New or mutating http.DefaultClient.

Type of change

• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Bug fix (non-breaking change which fixes an issue)
• Documentation update

Checklist:

Confirm you have completed the following steps:

• My code follows the style of this project.
• I have performed a self-review of my code.
• I have made corresponding updates to the documentation.
• I have added/updated unit tests to cover my changes.

Test plan

• go test ./pkg/account/ ./pkg/connector/inet/ -count=1
• go test ./... -count=1
• FromTokenSource refreshes Authorization across requests
• GetVehicle connection uses auth callback (credential errors surface on Wakeup)
• New(string) still sends the static bearer
• SetAuthHeaderFunc supplies a fresh header per inet Fleet API call