Auth session lifecycle: graceful re-auth on expiry, no token exposure after connect, clarify AD/credential login on 2.x

[dmann000]

Source: field feedback (auth lifecycle / security).

Three related gaps in how the module handles authentication and sessions:

1. No graceful re-auth on session expiry. When a session expires the module returns a bare 403. The FlashArray module re-authenticates gracefully. At minimum, detect the expired-session 403 and return a descriptive error that tells the caller to re-authenticate; ideally attempt a transparent re-auth using the stored credential.
2. API token exposed after connect. After Connect-PfbArray the API token is visible on the returned connection object. The token should not be surfaced in default output (store it non-displayably, e.g. behind a hidden/SecureString member).
3. Credential / AD login does not work on REST API 2.x. The cred/AD login argument exists in the code but does not work against 2.x (appears supported on 1.x). Clarify whether AD/credential auth is supported on 2.x or whether callers are expected to issue and rotate their own tokens. If it is an implementation bug, fix it; if it is unsupported, document the token workflow (issuance, rotation, storage) clearly.

Acceptance

• Expired session yields an actionable error (or a transparent re-auth), not a bare 403.
• Token is not present in the default formatted output of the connection object.
• Documented, tested guidance for AD/credential vs token auth on 2.x.