Fix async mirror-create review findings from #2207

Since #2246 made the async route the default, these are live for everyone rather than gated behind an opt-in flag.

Drives the placement poll off the 202 body's requestId instead of the Location header, which removes three problems at once: an optional header no longer fails a create whose body already reports success, no server-named host can become a poll target for the control-plane bearer, and the poll keeps 421ing to the home core so the transport's bare-401 re-exchange stays recoverable past the token cache. With nothing reading the header, the mirrorLocationCanonicalizer that maintained it goes too — it survived the auth-go/crossjuris refactor in 02abf214b, but its only consumer is gone.

Restores parity between the two routes: MirrorRequestResult carries no suspended field, so an async create against a suspended placement reported plain success and exited 0 where the sync route warns and exits non-zero. One status read fills it in for every caller.

Makes --wait-timeout cover submission, placement and clone on both routes. It previously bounded only the clone poll on the sync route, so a hanging CreateMirror ignored the flag; the help text documented that split rather than fixing it.

Also: an accepted request's id survives a wait that ended with no verdict, so the user has a handle on in-flight work — but not a terminal failure, which is done and must not be described as still progressing; the wizard labels a placement timeout "timed out" rather than "error"; one relabelled spinner replaces three per-phase spinners that each stamped their own check mark; and ENTIRE_ASYNC_MIRROR_REQUESTS overrides the route in both directions, since this command usually runs outside the repo whose settings.json holds the opt-out. A settings-load error is now reported instead of swallowed, without changing the route — a read that failed is not evidence the repo opted out.

Restores the poll-budget and createAndAwaitMirror rationale comments dropped in #2207, documents the new functions and the unreachable unknown-status branch, and records why the session-store FD test is deliberately not parallel.