[Feature Request] Support Anthropic Claude Max (OAuth token) as a provider

Problem
GoClaw currently only supports standard Anthropic API keys (sk-ant-api03-...) via the x-api-key header. However, many users (especially those migrating from OpenClaw) use Claude Max subscriptions, which issue OAuth Access Tokens (sk-ant-oat01-...).

These tokens:

Have a limited lifespan and expire periodically
Require an OAuth refresh flow to obtain new tokens
Work perfectly in OpenClaw's Node.js SDK, which handles the refresh automatically
When using an expired Claude Max OAuth token with GoClaw, the result is:

HTTP 401: {"type":"error","error":{"type":"authentication_error","message":"invalid x-api-key"}}

Proposed Solution
Add support for Anthropic OAuth token refresh in GoClaw's provider layer. This could be implemented as:

A new auth type in llm_providers (e.g., auth_type: "oauth") that stores both the access token and refresh credentials
An automatic refresh mechanism that detects 401 responses and refreshes the token before retrying
A CLI command (e.g., goclaw auth login anthropic) that initiates the OAuth flow and stores the token

Context

OpenClaw handles this transparently via its Node.js SDK (
auth-profiles.json
with type: "token")
MiniMax subscriptions work fine because they use standard API keys
This is currently the only blocker preventing a full migration from OpenClaw to GoClaw for Claude Max users

Environment

GoClaw version: dev (latest from main branch)
Deployment: Docker Managed Mode
OS: macOS (Colima)

Would love to see this supported natively. Happy to help test if a PR is in progress.

Start with the llm_providers layer and its existing Anthropic API-key handling; no specific files or tests are named. Define the scope for OAuth token storage, refresh after authentication failures, and the proposed goclaw auth login anthropic flow, then verify that Claude Max users can authenticate without repeated manual renewal.