feat(auth): provider resolves credentials via AuthContract, not config

- kernel HostAPI: add getAuthProviders()/getAuthProvider(id) read-views (mirrors getProviders)
- provider-openai-compat: activate() resolves creds via host.getAuthProvider("apikey").resolve(); dependsOn auth-apikey; model stays config-driven
- host-bin: mirror the new getters in post-activation HostAPI stub
- auth-apikey is no longer vestigial; auth seam exercised end-to-end
- 185 tests pass; typecheck + biome clean; verified live (curl returns real response)

3 files changed, 39 insertions, 0 deletions

diff --git a/packages/kernel/src/contracts/extension.ts b/packages/kernel/src/contracts/extension.ts
index 7078a9a..424f714 100644
--- a/packages/kernel/src/contracts/extension.ts
+++ b/packages/kernel/src/contracts/extension.ts
@@ -230,6 +230,12 @@ export interface HostAPI {
 	/** Read-only view of all registered tools. */
 	readonly getTools: () => ReadonlyMap<string, ToolContract>;
 
+	/** Read-only view of all registered auth providers. */
+	readonly getAuthProviders: () => ReadonlyMap<string, AuthContract>;
+
+	/** Look up a single auth provider by id. */
+	readonly getAuthProvider: (id: string) => AuthContract | undefined;
+
 	/** Register a scheduled job with the host's scheduler. */
 	readonly scheduler: {
 		readonly register: (job: ScheduledJob) => void;
diff --git a/packages/kernel/src/host/host.test.ts b/packages/kernel/src/host/host.test.ts
index f7b7eba..82d5177 100644
--- a/packages/kernel/src/host/host.test.ts
+++ b/packages/kernel/src/host/host.test.ts
@@ -632,6 +632,33 @@ describe("createHost", () => {
 			expect(capturedProviders?.size).toBe(1);
 			expect(capturedProviders?.get("anthropic")).toBe(provider);
 		});
+
+		it("getAuthProviders/getAuthProvider returns registered auth via HostAPI", async () => {
+			const auth = createFakeAuth("apikey");
+			let capturedAuth: ReadonlyMap<string, AuthContract> | undefined;
+			let capturedSingle: AuthContract | undefined;
+
+			const producer = createExtension("auth-apikey", {
+				activate: (host) => {
+					host.defineAuth(auth);
+				},
+			});
+			const consumer = createExtension("consumer", {
+				dependsOn: ["auth-apikey"],
+				activate: (host) => {
+					capturedAuth = host.getAuthProviders();
+					capturedSingle = host.getAuthProvider("apikey");
+				},
+			});
+
+			const host = createHost([producer, consumer], deps);
+			await host.activate();
+
+			expect(capturedAuth).toBeDefined();
+			expect(capturedAuth?.size).toBe(1);
+			expect(capturedAuth?.get("apikey")).toBe(auth);
+			expect(capturedSingle).toBe(auth);
+		});
 	});
 
 	describe("DAG errors", () => {
diff --git a/packages/kernel/src/host/host.ts b/packages/kernel/src/host/host.ts
index e0ca5d5..8592a16 100644
--- a/packages/kernel/src/host/host.ts
+++ b/packages/kernel/src/host/host.ts
@@ -132,6 +132,12 @@ export function createHost(extensions: readonly Extension[], deps: HostDeps): Ho
 			getTools() {
 				return tools;
 			},
+			getAuthProviders() {
+				return authProviders;
+			},
+			getAuthProvider(id: string) {
+				return authProviders.get(id);
+			},
 			scheduler: {
 				register(job: ScheduledJob) {
 					scheduledJobs.push(job);