fix: Keep org-specific token rotation isolated

[stray-nick]

Summary

Keep token rotation scoped to the current organization when that organization has its own configured token pool.

GitHub App installation tokens are org-scoped. If a stream is reading private repositories for one org and get_next_auth_token() falls through to another org's installation token, GitHub can return misleading 404 Not Found responses for repositories that do exist and are accessible with the correct org token.

What changed

• get_next_auth_token() now prefers the current organization's token managers when current_organization has a configured token pool.
• Fallback to org-agnostic or other-org tokens is still allowed when the current organization has no configured token pool.
• Added regression tests for both paths:
  • org-specific token rotation stays inside the current org's pool.
  • missing org-specific pools still use the existing fallback behavior.

Validation

uv run pytest tests/test_authenticator.py
# 44 passed