Bump fly-go to v0.9.7 and macaroon to v0.3.1

[dangra]

Picks up the fix for interactive third party discharges timing out while the user is still completing a browser login.

Context

The discharge client polled the third party on an unbounded doubling backoff inside a hardcoded 30 second context, so requests landed at t=0,1,3,7,15 and the next one was scheduled past the deadline: nothing was polled for the second half of the budget. A login finished in that window produced a discharge the CLI never collected, and Tokens.Update returned context deadline exceeded even though the browser reported success.

superfly/fly-go#286 caps the polling interval at a second and raises the discharge timeout to 90 seconds, now configurable per call through tokens.WithDischargeTimeout. superfly/macaroon#46 makes the poll loop clamp its backoff against the caller's deadline, so a final poll always lands before the context expires.

Worth knowing when reading the new numbers: refreshDischargeTokens in internal/config/tokens.go calls Tokens.Update twice, each building its own context, so the worst case a user can observe is about twice the timeout fly-go uses.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.