Reconsider host-level agent auth state

Currently each client must independently obtain OAuth tokens and push them to the host via authenticate. The token lifecycle (refresh, expiry) is also per-client. In practice this means the host holds N copies of the same Copilot
token for N connected clients — all granting access to the same GitHub account on the same machine.

The per-client isolation this model assumes doesn't exist in practice. In the VS Code agent host, all clients share a single process. Any connected client can execute arbitrary commands and access credentials on the host via tool
calls. Per-client token isolation would only be meaningful with per-client sandboxing, which the current architecture doesn't provide.

Suggestion: Make agent auth state host-level. The host manages tokens for agents like Copilot centrally — obtaining, storing, and refreshing them. Clients authenticate their connection to the host (--connection-token), not
separately with each agent's upstream service.

Clients could still assist with the initial auth flow when the host has no token (e.g. presenting a device code UI and passing the result back), but the token would be stored and refreshed by the host, shared across all
connections. This also simplifies reconnection — clients don't need to re-push tokens after a dropped connection.

ahpx already works around this by resolving GitHub tokens from the environment (GITHUB_TOKEN / gh auth token) client-side — effectively treating agent auth as a host-level concern.

Spec references

• Per-client auth flow: authentication.md#L7-L25
• Per-resource, not per-connection: authentication.md#L197-L202
• Per-connection rationale: authentication.md#L204-L206

Start with docs/specification/authentication.md, especially the per-client flow at lines 7–25 and the per-resource and per-connection rationale at lines 197–206. Compare those sections with the proposed host-level lifecycle and define the protocol changes needed for shared token storage, refresh, and client-assisted initial authentication. Done means the authentication specification and its rationale consistently describe the accepted model.