Provider auth metadata is duplicated three ways with nothing guarding the drift

Follow-up from #429, which was caused by exactly this class of drift.

The provider→env-var mapping exists in three places right now:

- `PROVIDER_ENV_MAP` in `bin/loom.js`
- `PROVIDER_ENV_MAP` in `app/src/main/agent.ts`
- `PROVIDER_KEY_VARS` in `shared/brain-env.js`

The third already carries a comment saying it "must stay a superset" of the other two, with a test guarding that one relationship -- which is a decent sign the shape is wrong. Nothing guards the first two against each other.

Related: which providers authenticate *only* by sign-in is now a hardcoded set in `bin/loom.js` (`OAUTH_ONLY_PROVIDERS`) and a registry-derived one in `app/src/main/oauth-handler.ts`. After #429 they agree on semantics, but nothing keeps them agreeing the next time pi adds a provider or gives an existing one an OAuth flow. That's precisely how #429 happened: pi gave Anthropic a sign-in flow and one side noticed.

Proposal:

- One pure, capability-oriented module in `shared/` holding the env-var map and the OAuth-only set. Pure is the important word -- it should classify supplied provider metadata, not construct a `ModelRuntime`. The brain does this work synchronously at module top level, and pulling pi's runtime into `shared/` also risks the duplicate pi-ai module-state problem already documented in `app/vite.main.config.ts`.
- A root test asserting that set against pi-ai's actual registry. `pi-ai` is already a root devDependency, so this is cheap, and it means the next pi bump fails CI instead of failing users.

Not urgent -- #429's fix is correct as it stands. This is about it staying correct.

Start by reading the three provider mappings in bin/loom.js, app/src/main/agent.ts, and shared/brain-env.js, then inspect OAUTH_ONLY_PROVIDERS in bin/loom.js, oauth-handler.ts, the existing superset test, and app/vite.main.config.ts. Confirm how the root test can inspect pi-ai's registry. Done means shared capability metadata is used consistently and CI detects drift in both mappings and OAuth-only providers.

Written by the indexing model from the issue text.