fix(auth): recover from provider credential failures

[TheGreatAxios]

Summary

• re-resolve the exact OAuth profile and retry uncommitted credential failures once without silent provider failover
• redact provider credentials across diagnostics and show actionable /connect recovery with explicit provider switching
• make Codex and xAI credential rotation race-safe and document the recovery contract

Verification

• bun run check passes
• focused authentication, retry, redaction, race, and TUI recovery suites pass

Fixes CL-9347

[linear-code]

CL-9347

[TheGreatAxios]

Primary review: approved. The full branch passes the repository gate, including 8,072 randomized tests, and all CL-9347 recovery, replay, redaction, and race-safety criteria are satisfied.

[TheGreatAxios]

Critic review: approved with no blocking or should-fix findings. Exact-source OAuth recovery, actionable guidance, credential sanitization, selector identity validation, and replay fences are covered by permanent regressions.

[TheGreatAxios]

Warden security review: GO. Provider-auth provenance, authoritative refresh winners, access and refresh credential redaction, concurrent refresh races, and explicit switch authorization are closed with synthetic-secret tests.

[TheGreatAxios]

Greybeard architecture review: approved. Credential stores own committed winners, provider sessions install exact winners, the inference harness owns immutable retry and commitment state, and the TUI owns generation-scoped explicit recovery.