docs/aws-sso.md: setup guide, modes per device type, log reference, troubleshooting

Also: unprompted-login back-off now matches the guide (30 min, 1 h, 2 h,
then 4 h; the first retry was 1 h); README links the guide.

README.md

@@ -358,6 +358,8 @@ Each extension is a TypeScript module loaded by [jiti](https://github.com/unjs/j
 
 ### `aws-sso.ts`
 
+Setup guide, modes per device type, log reference and troubleshooting: [docs/aws-sso.md](docs/aws-sso.md).
+
 Keeps a Bedrock **AWS SSO** session alive, like Claude Code's `awsAuthRefresh`:
 when the IAM Identity Center session ends it runs `aws sso login` for you, before a
 request fails. **You still approve the login** (or your browser does it silently
@@ -406,8 +408,8 @@ fingerprints (`~/.pi/agent/aws-sso/events.jsonl`); the token the SDK returns is
 dropped unread.
 
 **Triggers:** a 20 s timer that checks every 60 s inside the refresh window (every
-10 min once the token has run out). Unprompted logins back off (30 min, doubling
-per unanswered login, at most 4 h), so one waiting for you does not pile up tabs or
+10 min once the token has run out). Unprompted logins back off (retries after 30 min,
+1 h, 2 h, then every 4 h), so one waiting for you does not pile up tabs or
 pushes overnight. `before_agent_start`
 checks first if the token is in its window and logs in (and waits) if the session
 is over. `message_end` is the fallback: if a request still fails on an expired