core oauth rotation

[jroth1111]

• core: subscription OAuth pools + same-request rotation
• fix: share OAuth creds across provider aliases
• core: encrypted credential pools + rotating OAuth fetch
• core: add model discovery, vault CLI, credential manager, rotation stats
• fix(mcp): use credential store for oauth state
• docs: update provider auth v2 rfc