provider/*: support an expiring-credential source (token helper), not just a static API key

Follow-up to #573 (closed: the provider/* adapters already exist per ADR 0093). This is the one part of that issue's ask that is genuinely unbuilt, split out as requested in the closing comment.

Problem

The public provider adapters (provider/anthropic, provider/openai, provider/openaichat) authenticate with a static key baked in at construction — WithAPIKey is a fixed string. A common deployment mints short-lived credentials from a token helper, so a run can outlive its credential and lose access mid-run with no re-mint path. The only token-refresh code in the repo is root-side composition (internal/app/registry.go, bearerRoundTripper) and is narrower than what's needed: hardcoded Authorization: Bearer with no x-api-key alternative, no refresh-and-retry on auth rejection, no single-flight, and coupled to toolhivellm.DirectTokenSource. So a builder who needs expiring credentials has to rebuild this today.

What a shipped adapter should own out of the box

Support a caller-supplied credential source the adapter invokes on demand, not a value fixed at construction. That means the adapter owns the credential lifecycle:

• fetch from the source and reuse across requests (don't re-invoke the helper per call),
• on a provider auth rejection, refresh from the source and retry once, transparently — token expiry is a normal, expected event, not an error to surface,
• do this safely under concurrent requests (one refresh, not a stampede),
• carry the credential in the header style the target requires — Authorization: Bearer <token> or x-api-key: <token>, as two mutually exclusive choices selectable by the caller (which one a target accepts depends on whether it's the vendor API or a fronting gateway, not on the credential); and on a refresh-and-retry, clear the unused header so a replayed request never carries a stale one.

Static-key auth (WithAPIKey) stays the simple path; the expiring-credential path is the one a builder shouldn't have to rebuild.

Start with the adapters in provider/anthropic, provider/openai, and provider/openaichat, then compare the existing bearerRoundTripper in internal/app/registry.go. Trace how WithAPIKey supplies credentials and define the source, header selection, refresh-and-retry, reuse, and concurrent-refresh behavior. Done means expiring credentials work across the public adapters while static-key authentication remains unchanged.