fix enrollment retry handling

[a16i]

Summary

• retry idempotent enrollment refreshes after transient request failures, including the SEPA 400 response
• stop after three attempts and show a retryable error instead of polling forever
• pause background polling while an error or manual retry is active
• preserve the real request error, status code, and refresh or action stage in telemetry
• add regression coverage for transient, permanent, and persistent failures

Test plan

• cd packages/sdk && pnpm test

---