[kevmo314]

Follow-ups from the #1694 review.

Lost reconcile: subscribeTwitch enqueues a reconcile while it still holds the twitch:<id> lease, so the worker parks the reconcile as busy for 5s. If a late authorization_revoked revocation from an earlier deauthorization lands in that window, EnqueueRemove overwrites item.job. The removal then sees the broadcaster re-authorized, skips, and deletes the item, so the reconcile is gone and no subscriptions get created until the next subscribe. Items now carry a reconcile flag that is set whenever a reconcile is requested. A removal that ends with outcome reauthorized switches the item back to the reconcile with fresh retry state instead of dropping it. A removal that actually deletes still drops the item, so a real deauthorization after a subscribe still wins.

Tests in TestTwitchQueueLatestIntentWins:

• stale revocation while reconcile is parked fails on main.
• re-authorized without a reconcile checks that a plain skipped removal does nothing.

HTTP client: cmd/main.go left subscriptions.API.Client nil, so every Helix request (now including the /users re-authorization check) built a new http.Client. One client is now shared between provider.NewService and API.Client, the same way jobs.go does it.