fix(auth): harden Claude OAuth credential pools

[eddieparc]

Summary

• preserve provider-owned OAuth account pools instead of double-appending their flat compatibility credential
• recognize concrete OAuth credentials selected by shared credential rotation
• keep synthetic managed sentinels excluded from readiness checks
• classify OAuth refresh DNS, connection, timeout, socket, and fetch failures as temporary provider errors
• retain persistent account blocking for invalid_grant, invalid_token, revoked tokens, HTTP 401, and unauthorized responses

Root causes

1. The shared login layer appended the Claude provider's already-complete account pool a second time, creating a fake slot from its managed sentinel.
2. The managed auth lane wrapped every token-refresh exception as authentication_failed, so a DNS outage permanently blocked a valid account until re-login.

Verification

• transient/auth classification regression: 5 cases passed
• Claude OAuth regression suite: 5 files, 50 tests passed
• credential pool regression: 5 tests passed
• TypeScript, Biome, full monorepo build, browser smoke, and repository pre-commit checks passed
• Anthropic DNS and HTTPS probes passed 3/3 after the outage
• expired-token refresh succeeded and three consecutive live claude-sdk-oauth requests passed with fallback disabled

[eddieparc]

Cross-reference: Linear OLI-281 (https://linear.app/oliveline/issue/OLI-281/senpi-claude-sdk-oauth-provider-%EB%9D%BC%EC%9A%B0%ED%8C%85%EC%9C%BC%EB%A1%9C-OMO-%EC%84%B8%EC%85%98-%EC%9E%AC%EA%B0%9C-%EC%8B%A4%ED%8C%A8), GitHub issue #1261 (#1261). Real Orca QA on resumed session 01a05add-8e0c-7918-b2c8-551e0298a50d returned RESUME_OK without a new provider-configuration error using claude-sdk-oauth/claude-opus-5:high.