feat(auth): provider resolves credentials via AuthContract, not config

- kernel HostAPI: add getAuthProviders()/getAuthProvider(id) read-views (mirrors getProviders)
- provider-openai-compat: activate() resolves creds via host.getAuthProvider("apikey").resolve(); dependsOn auth-apikey; model stays config-driven
- host-bin: mirror the new getters in post-activation HostAPI stub
- auth-apikey is no longer vestigial; auth seam exercised end-to-end
- 185 tests pass; typecheck + biome clean; verified live (curl returns real response)

1 files changed, 5 insertions, 0 deletions

diff --git a/packages/host-bin/src/main.ts b/packages/host-bin/src/main.ts
index a3eb164..fe36e80 100644
--- a/packages/host-bin/src/main.ts
+++ b/packages/host-bin/src/main.ts
@@ -57,6 +57,8 @@ function buildPostActivationHostAPI(
 	host: {
 		getProviders: () => ReadonlyMap<string, unknown>;
 		getTools: () => ReadonlyMap<string, unknown>;
+		getAuthProviders: () => ReadonlyMap<string, unknown>;
+		getAuthProvider: (id: string) => unknown;
 	},
 	deps: HostDeps,
 ): HostAPI {
@@ -79,6 +81,9 @@ function buildPostActivationHostAPI(
 		logger: deps.logger,
 		getProviders: () => host.getProviders() as ReturnType<HostAPI["getProviders"]>,
 		getTools: () => host.getTools() as ReturnType<HostAPI["getTools"]>,
+		getAuthProviders: () => host.getAuthProviders() as ReturnType<HostAPI["getAuthProviders"]>,
+		getAuthProvider: (id: string) =>
+			host.getAuthProvider(id) as ReturnType<HostAPI["getAuthProvider"]>,
 		scheduler: { register: (job: ScheduledJob) => deps.scheduler.register(job) },
 	};
 }