Improve UX of `force_provider_authentication` with ssh and sudo

Currently, when the provider is not reachable when trying to log in with the local password via ssh or sudo, the user is asked for the local password again:

```
ssh test@ubudev1.onmicrosoft.com@localhost
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to choose the provider
(test@ubudev1.onmicrosoft.com@localhost) Enter your local password:
>
authentication failure: could not refresh token: provider is not reachable
== Local Password Authentication ==
Enter 'r' to cancel the request and go back to choose the provider
(test@ubudev1.onmicrosoft.com@localhost) Enter your local password:
>
```

```
sudo ls
authentication failure: could not refresh token: provider is not reachable
Sorry, try again.
Enter your local password:
>
```

The provider is likely not reachable on the second try, so we should not ask for the password again but just let the login fail. If we want the error message to be more actionable, we could add something like "Check your internet connection and try again".

Reproduce the provider-unreachable flow through both ssh and sudo, then trace how force_provider_authentication handles the failed token refresh and retry. Done means the second failure stops authentication without asking for the local password again; consider the issue's suggested connectivity guidance only if the existing error path supports it.

Written by the indexing model from the issue text.