Support authentication with oAuth

[bhagyas]

Not just the API Key. Look at Pi Harness for inspiration.

[nickjalbert]

Thanks for the report! Headlong now has a written provider policy, and the policy defines where OAuth support belongs.

bin/llm will not implement general OAuth flows, token refresh, or vendor login handling. Providers that need authentication beyond an API key in an HTTP header use an external adapter instead.

The adapter interface is implemented. Operators set LLM_PROVIDER=adapter and LLM_ADAPTER=/path/to/executable, and the adapter owns authentication, token storage, and token refresh. Pi is useful prior work for the provider specific implementation, but Headlong keeps those authentication details outside core.

PR #46 is being directed toward the same interface for ChatGPT subscription authentication and should provide a concrete example.

I am closing this broad issue because the architecture is now decided and implemented. I would be happy to review an adapter for a specific provider or OAuth flow.