OAuth2 client credentials is declared but refused, so Xero and Google cannot be connected

`ConnectorAuth.OAuth2ClientCredentials` is a declared auth mode. `ConnectorSender` refuses it at send time: "OAuth2ClientCredentials is not implemented yet. Use BearerToken with a token you obtained, or ApiKeyHeader." (`Infrastructure/Connectors/ConnectorSender.cs:232-236`).

The workaround is real but short-lived. A client-credentials token expires, usually in an hour, so BearerToken means an operator pasting a fresh token every hour. That is not a configuration anybody runs.

## What this blocks

The providers a business system actually needs. Xero custom connections, Google APIs including Drive, most partner APIs. Every one of them is client credentials or a refresh flow. Today none of them can be reached through a connector, which is the whole point of connectors.

## What to add

The client-credentials exchange, with the token cached until shortly before expiry and refreshed on a 401. The client secret goes in the existing secret store, which already holds values as AES-GCM ciphertext under `Connectors:Key` and never returns them over the API.

Worth deciding in the thread: whether the cached token is per instance or shared. Per instance is simpler and means N instances each hold a token, which most providers allow and some rate limit.

## Done when

- A connector configured for client credentials obtains a token and calls a provider.
- The token is refreshed before expiry, and a 401 triggers one retry with a fresh token rather than failing the action.
- The secret is never logged and never returned by any endpoint.

Start in Infrastructure/Connectors/ConnectorSender.cs:232-236 to trace how OAuth2ClientCredentials is currently rejected, then inspect the existing secret store using AES-GCM ciphertext under Connectors:Key. Define the token exchange, caching and 401 retry behavior, including the per-instance versus shared-cache decision. Done means a configured connector can call a provider, refresh before expiry or once after a 401, and never expose or log the secret.

Written by the indexing model from the issue text.