feat: support request-scoped OAuth credentials

[roackb2]

Summary

• Add a public request-scoped OpenAI access-token credential for embedded runtimes.
• Resolve one concrete credential principal and keep it consistent across the main turn, compaction, and provider-backed tools.
• Preserve stored OAuth refresh behavior while ensuring runtime tokens are never refreshed or persisted.
• Reject ambiguous API-key plus runtime-token configuration and expired runtime tokens with a stable 401-class error.
• Document the adopter and host lifecycle and SDK usage.

Boundary

This PR consumes an access token that the embedding host already acquired. It does not implement browser sign-in, an OAuth redirect endpoint, refresh-token storage, or tenant authentication.

Verification

• yarn typecheck
• yarn lint
• yarn test:unit — 123 files, 727 tests
• yarn build
• All six GitHub checks pass.

Focused coverage includes credential precedence and validation, OpenAI request rewriting and no-persistence behavior, expiry, conversation SDK propagation, compaction, and external-context web search.