fix(pia): request port-forwarding tokens from PIA's v2 endpoint

[twistedmelonman]

Summary

On 2026-10-12, after a container recreate at 11:33, pia-port-watchdog sent
its "port forwarding lost" alert. The tunnel was healthy, and the guard kept
the existing peer port, so downloads continued unforwarded. Every token
request failed for over an hour.

The cause was PIA's legacy /gtoken/generateToken endpoint. On most calls it
answered HTTP 500 with "server error: all APIs down; please report bug". The
v2 endpoint /api/client/v2/token, which PIA's own
pia-foss/manual-connections/get_token.sh uses, issued tokens normally.

Changes

• transmission-post-start.sh asks v2 first, with --form-string
  credentials, and falls back to the legacy endpoint.
• Each token request retries (--retry 3). curl's retry set includes HTTP 500.
• A failed request logs the HTTP status and PIA's message, or curl's own
  error. The old code sent stderr to /dev/null and could only log "network
  or auth".
• pia-pf-probe.sh uses v2 too, so an outage like this one does not make
  every region probe as token_failed.
• The README gets an incident section and a manual check for both endpoints.
  It also corrects a claim that probe credentials stay out of the process
  table; they do not.
• Both touched test files had shellcheck info findings from before this
  change. They are fixed, because the commit hook lints whole files.

Verification

• 7 new BATS tests, with a stubbed curl, for v2 success, fallback, both
  failing, network error, --form-string credentials, and retry. All fail
  against the old code and pass against the new code.
• Live, from inside the running container: v2 issued a token 3 of 3 times,
  and getSignature accepted a v2 token (status OK, port assigned).
• shellcheck -S info and shfmt are clean.

Deploy

The running container does not pick this up until the setup script
redeploys transmission-post-start.sh and the container is recreated.

Not done

• No RETURN trap for the curl stderr temp file. The file leaks only if the
  function is interrupted mid-request.
• Credentials still reach curl as arguments inside the container. That
  exposure is the same as before this change.