Fix Paycom credential saves under DSP capacity contention

[dillonlille]

When two DSPs keep idle authentication workers warm through status polling, a third DSP can time out while saving Paycom credentials. First-time enrollment also depends on a collection-runtime slot, and a failed save leaves the dialog disabled until another status request finishes.

This change lets idle authentication workers yield to queued DSPs while preserving active requests, sign-ins and plugin browser leases. Directory enrollment sends credentials directly to the selected DSP vault worker; onboarding remains queued at runtime capacity and resumes without consuming failure retries. The dialog permits cancellation while an uncertain save is reconciled and prevents resubmission until it is closed.

Validation:

• Core source checks and production build passed.
• 120 unit tests and 134 integration tests passed; 34 targeted account/enrollment/persistence checks passed.
• Five Playwright checks passed on desktop and mobile, including encrypted persistence and cancellation during a stalled status refresh.
• Native authentication acceptance passed with real isolated Chrome and DSP vault persistence across worker restart.
• Regression tests fail against the pre-fix authentication/enrollment implementations.

All fixtures and credentials are synthetic. No production deployment, real provider login, DSP release, SDK package change or database schema migration is included.