fetch: client timeout, retry with backoff, url.JoinPath (closes #63)

fetch now makes every request through an http.Client with a time
limit, ten minutes by default and set with --timeout, which must be
greater than zero. A connection error, a timeout, or a 5xx or 429
response is retried, up to five tries in all, after a random wait
whose limit doubles from one second, or after the wait the server's
Retry-After asks for, up to one minute. Each try of a file starts a
new temp file, so a retry never keeps a partial file; the size and
hash checks are unchanged. Manifest and file URLs are built with
URL.JoinPath, so trailing slashes, query strings and names that need
escaping all work.

Model: opus-5-5

internal/cli/mfer.go

@@ -23,6 +23,7 @@ const (
 	cmdVersion  = "version"
 
 	flagProgress = "progress"
+	flagTimeout  = "timeout"
 
 	manifestArgsUsage = "[manifest file]"
 
@@ -346,7 +347,14 @@ func (mfa *CLIApp) fetchCommand() *cli.Command {
 
 			return mfa.fetchManifestOperation(c)
 		},
-		Flags: commonFlags(),
+		Flags: append(commonFlags(),
+			&cli.DurationFlag{
+				Name:  flagTimeout,
+				Value: httpTimeout,
+				Usage: "Time limit for each HTTP request, including the download " +
+					"of its body",
+			},
+		),
 	}
 }