Container credentials client sleeps after the final failed attempt

从 HttpCredentialsClient.get_credentials() 开始，检查 issue 中描述的异常处理重试循环。添加或更新一个回归测试，对 asyncio.sleep 进行 mock，并验证两次尝试产生一次 sleep，而最终失败会立即抛出；terminal SmithyIdentityError 应保持不变。

Describe the bug

HttpCredentialsClient.get_credentials() waits for the retry delay after every failed attempt, including the final attempt when no retry remains. This adds one second of unnecessary latency before the client raises its terminal SmithyIdentityError.

With the default three attempts, a terminal failure incurs three one-second sleeps even though only two delays are needed between attempts. With retries=1, the single request still takes about one extra second to fail.

Regression Issue

This does not appear to be a regression.

Expected Behavior

The client should sleep only between attempts. After the final attempt fails, it should raise immediately.

Current Behavior

The except block awaits asyncio.sleep(_SLEEP_SECONDS) before incrementing/checking the attempt count, so the final failure always sleeps before leaving the loop.

Reproduction Steps

import asyncio
from time import monotonic

from aws_credentials_http.client import HttpCredentialsClient
from smithy_core import URI
from smithy_core.exceptions import SmithyIdentityError
from smithy_http import Fields


class FailingClient:
    async def send(self, *args, **kwargs):
        raise OSError("endpoint unavailable")


async def main():
    client = HttpCredentialsClient(FailingClient(), retries=1)  # type: ignore[arg-type]
    started = monotonic()
    try:
        await client.get_credentials(
            URI(scheme="http", host="169.254.170.2", path="/credentials"),
            Fields(),
        )
    except SmithyIdentityError:
        print(f"elapsed: {monotonic() - started:.1f}s")


asyncio.run(main())

On aws-credentials-http==0.3.0, this prints approximately elapsed: 1.0s even though only one request is configured and there is no subsequent retry to wait for.

Possible Solution

Increment the attempt count first, then await the retry delay only when attempts < self._retries. A regression test can mock asyncio.sleep and assert that two attempts produce one sleep.

Additional Information/Context

Confirmed against the current develop branch (5fed4da) and the latest published aws-credentials-http release, 0.3.0.

Affected area

credentials / authentication

Affected package(s)

aws-credentials-http 0.3.0

Python version used

Python 3.14.0

Operating System and version

macOS 27.0.1