feat(auth): provider resolves credentials via AuthContract, not config

- kernel HostAPI: add getAuthProviders()/getAuthProvider(id) read-views (mirrors getProviders)
- provider-openai-compat: activate() resolves creds via host.getAuthProvider("apikey").resolve(); dependsOn auth-apikey; model stays config-driven
- host-bin: mirror the new getters in post-activation HostAPI stub
- auth-apikey is no longer vestigial; auth seam exercised end-to-end
- 185 tests pass; typecheck + biome clean; verified live (curl returns real response)

1 files changed, 6 insertions, 0 deletions

diff --git a/packages/kernel/src/contracts/extension.ts b/packages/kernel/src/contracts/extension.ts
index 7078a9a..424f714 100644
--- a/packages/kernel/src/contracts/extension.ts
+++ b/packages/kernel/src/contracts/extension.ts
@@ -230,6 +230,12 @@ export interface HostAPI {
 	/** Read-only view of all registered tools. */
 	readonly getTools: () => ReadonlyMap<string, ToolContract>;
 
+	/** Read-only view of all registered auth providers. */
+	readonly getAuthProviders: () => ReadonlyMap<string, AuthContract>;
+
+	/** Look up a single auth provider by id. */
+	readonly getAuthProvider: (id: string) => AuthContract | undefined;
+
 	/** Register a scheduled job with the host's scheduler. */
 	readonly scheduler: {
 		readonly register: (job: ScheduledJob) => void;