feat(yarn_client): auth config for YARN REST (none/simple/basic/kerberos)

Add per-Connection authentication so CDH 5 / Kerberos / HTTP Basic
clusters can be queried.

- auth_type: none / simple / basic / kerberos
- auth_user / auth_password for HTTP Basic
- auth_principal / auth_keytab stored for audit/display; actual SPNEGO
  handled by httpx-kerberos using the system Kerberos credential cache
- YarnClientConfig.auth_for_httpx() returns the right httpx.Auth object
- _request passes auth= through to httpx.request alongside verify=

New dependency: httpx-kerberos.

Tests cover none/simple (no auth object), Basic auth header,
Kerberos auth object, missing basic user, invalid auth_type, and
tool-layer config propagation.

tests/unit/test_status_tool.py

@@ -8,6 +8,7 @@ from spark_executor.core.job_store import JobStore
 from spark_executor.core import connection_store
 from spark_executor.models import Connection, Job
 from spark_executor.tools import connections, status
+from spark_executor.core.yarn_client import YarnClientConfig
 
 
 def _fresh_stores():
@@ -67,3 +68,38 @@ def test_get_job_status_raises_when_connection_missing():
     )
     with pytest.raises(KeyError, match="Connection not found"):
         status.get_job_status("abc")
+
+
+def test_get_job_status_passes_auth_config():
+    _fresh_stores()
+    status.conn_store.save(
+        Connection(
+            name="secure",
+            master="yarn",
+            yarn_rm_url="http://rm:8088",
+            auth_type="basic",
+            auth_user="hdfs",
+            auth_password="secret",
+        )
+    )
+    status.store.put(
+        Job(
+            job_id="abc",
+            application_id="application_1",
+            script_path="/tmp/j.py",
+            queue="default",
+            submit_time=datetime(2026, 6, 24),
+            connection="secure",
+            yarn_rm_url="http://rm:8088",
+        )
+    )
+    with patch(
+        "spark_executor.tools.status.get_application_status",
+        return_value=("RUNNING", "State : RUNNING\n"),
+    ) as m:
+        status.get_job_status("abc")
+    args = m.call_args.args
+    assert args[0] == "application_1"
+    assert isinstance(args[1], YarnClientConfig)
+    assert args[1].auth_type == "basic"
+    assert args[1].auth_user == "hdfs"