hub: the Gitea client keeps its connections (MaxIdleConnsPerHost was 2)

Third and last leg, found the same way as the second — by not accepting that the numbers matched the
arithmetic when they did not. After the fan-out and the side-by-side resolve the page was ~11.9s mean
where ~3s was predicted.

Cause: the client used http.DefaultTransport, whose MaxIdleConnsPerHost is 2. Above that Go opens a
connection per request and discards it after, so under a 16-way fan-out almost every call paid a
fresh TCP setup AND a fresh authentication. Authentication is the expensive half: unauthenticated
/api/v1/version answers in ~0.03s while an authenticated package call takes ~0.24s against the same
Gitea instance.

Transport sized to the fan-out: MaxIdleConnsPerHost 16, MaxConnsPerHost 16 as a ceiling so a large
package list can never stampede Gitea harder than the fan-out needs, IdleConnTimeout 90s.

hub/CHANGELOG.md

@@ -1,4 +1,4 @@
-## v0.100.1 — the Configuration page took 26 seconds, and it was never hashing anything (2026-08-08)
+## v0.100.2 — the Configuration page took 26 seconds, and it was never hashing anything (2026-08-08)
 
 **Measured, not guessed:** `GET /configuration` → **HTTP 200 in 26.2 s**.
 
@@ -37,6 +37,12 @@ and that search is the slowest single call here: measured in-cluster at **1.1–
 
 **The cap stays at 20** and now bounds the fan-out too, not just the rendered list.
 
+**And the client no longer uses `http.DefaultTransport`**, whose `MaxIdleConnsPerHost` is **2**.
+Above that it opens a connection per request and discards it, so under a 16-way fan-out nearly every
+call paid a fresh TCP setup *and* a fresh authentication — and the authentication is the expensive
+half: an unauthenticated `/api/v1/version` answers in **~0.03 s** where an authenticated package call
+takes **~0.24 s** against the same Gitea. The transport is now sized to the fan-out (16).
+
 **MEASURED HONESTLY, because the first fix did less than the arithmetic predicted and that mattered.**
 Concurrency alone took 26.2 s to ~11–18 s, not the ~2 s expected. Chasing the gap is what found the
 package SEARCH — `/api/v1/packages/admin?type=generic&q=…` — which no amount of per-version fan-out