docs/aws-sso.md: setup guide, modes per device type, log reference, troubleshooting

Also: unprompted-login back-off now matches the guide (30 min, 1 h, 2 h,
then 4 h; the first retry was 1 h); README links the guide.

extensions/aws-sso.ts

@@ -183,9 +183,12 @@ export function resolveMode(state: State, env: Record<string, string | undefined
 	return { mode: "local", source: "default" };
 }
 
-/** Gap before the next unprompted login: 30 min, doubling per unanswered login, max 4 h. */
+/**
+ * Gap since the last unprompted login before the next one: 30 min after a success or
+ * the first unanswered login, then 1 h, 2 h, and at most 4 h.
+ */
 export function autoLoginGap(failures: number): number {
-	return Math.min(30 * 60e3 * 2 ** Math.max(0, failures), 4 * 3600e3);
+	return Math.min(30 * 60e3 * 2 ** Math.max(0, failures - 1), 4 * 3600e3);
 }
 
 export interface Push { title: string; message: string; click?: string; priority?: "min" | "low" | "default" | "high" | "urgent"; tags?: string[] }