auth v2 model discovery

[jroth1111]

• core: subscription OAuth pools + same-request rotation
• fix: share OAuth creds across provider aliases
• core: encrypted credential pools + rotating OAuth fetch
• fix(mcp): use credential store for oauth state
• fix(credentials): make legacy migration idempotent
• test(mcp): increase headers test timeout
• fix(mcp): lazy-load remote transports
• test(mcp): stub client creation for deterministic header tests
• fix(auth-v2): address review issues
• refactor(auth): remove legacy V1 encryption and enforce AAD binding
• feat(provider): opt-in model discovery for openai-compatible