fix: resolve Bitbucket 429 rate limiting and sync issues

[akshay-gupta7]

Why does this PR exist?

Closes #0000

What does this pull request do?

Testing this change

Additional Notes (if any)

[changeset-bot]

⚠️ No Changeset found

Latest commit: 367e392

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[github-actions]

⤵️ 📦 ✨ The artifact was successfully created! Want to test it? Download it here 👀 🎁

[github-actions]

Commit SHA:bc55d2ec2d59ef7ac6856bf892406b932161b8b1

Test coverage results 🧪

Code coverage diff between base branch:main and head branch: akshay/update-bitbucket-api 

Status	File	% Stmts	% Branch	% Funcs	% Lines
🟢	total	61.53 (-0.03)	53.07 (0.03)	59.41 (0.09)	61.93 (-0.02)
🟢	packages/tokens-studio-for-figma/src/storage/BitbucketTokenStorage.ts	46.95 (-2.41)	41.58 (2.75)	68 (12.45)	47.16 (-1.87)

[github-actions]

Commit SHA:bc55d2ec2d59ef7ac6856bf892406b932161b8b1
Current PR reduces the test coverage percentage by 1 for some tests

[anathaniel-TS]

🛡️ Hyma Compliance Check

⚠️ 1 finding(s) across 1 file(s)

Severity	Category	File	Headline
🟢 LOW	Access Control	packages/tokens-studio-for-figma/src/storage/BitbucketTokenStorage.ts	Bitbucket Basic-auth credential handling centralized into a shared retry/fetch helper

Full finding details

[Access Control] Bitbucket Basic-auth credential handling centralized into a shared retry/fetch helper

• File: packages/tokens-studio-for-figma/src/storage/BitbucketTokenStorage.ts (lines 53-56, 493-533; call sites throughout ~62-340)
• Implication: The user's Bitbucket username:apiToken Basic-auth credential is now assembled once in getAuthHeader() and attached by a new fetchWithRetry wrapper that adds 429/5xx backoff and sequential/batched requests. This is a refactor of existing behavior to an existing user-configured Git subprocessor (Bitbucket) — no new external destination, package, or additional data is introduced — but it consolidates how the credential is applied to outbound requests.
• Recommended action: Before/after merging, confirm the API token is still sourced only from the user's sync configuration (never logged or hardcoded), that the new wrapper sends the Authorization header exclusively to api.bitbucket.org over HTTPS, and that retried/backed-off requests do not duplicate or leak the credential.

ℹ️ This check is informational — findings do not block merging.
🛡️ Hyma Compliance Check · automated