fetch: client timeout, retry with backoff, url.JoinPath (closes #63)

fetch now makes every request through an http.Client with a time
limit, ten minutes by default and set with --timeout; the manifest
loader shares that default. A connection error, a timeout, or a 5xx
or 429 response is retried, up to five tries in all, after a random
wait whose limit doubles from one second, or after the wait the
server's Retry-After asks for, up to one minute. Each try of a file
starts a new temp file, so a retry never keeps a partial file; the
size and hash checks are unchanged. Manifest and file URLs are built
with URL.JoinPath, so a base URL with or without a trailing slash or
with a query string, and names that need escaping, all work.

Model: opus-5-5

internal/cli/mfer.go

@@ -23,6 +23,7 @@ const (
 	cmdVersion  = "version"
 
 	flagProgress = "progress"
+	flagTimeout  = "timeout"
 
 	manifestArgsUsage = "[manifest file]"
 
@@ -346,7 +347,14 @@ func (mfa *CLIApp) fetchCommand() *cli.Command {
 
 			return mfa.fetchManifestOperation(c)
 		},
-		Flags: commonFlags(),
+		Flags: append(commonFlags(),
+			&cli.DurationFlag{
+				Name:  flagTimeout,
+				Value: httpTimeout,
+				Usage: "Time limit for each HTTP request, including the download " +
+					"of its body",
+			},
+		),
 	}
 }