auth v2 core

[jroth1111]

Context: #5748.

Summary

This PR is the foundational "auth v2" refactor: encrypted-at-rest credentials + multi-account OAuth subscriptions, and a fetch-level rotation/refresh engine so OpenCode can retry within the same user request when a subscription is throttled or expires.

Why: the current auth path is single-credential and makes pooling/rotation/refresh brittle. Auth v2 makes subscription pools and API-key mode coexist cleanly while keeping the integration point provider-agnostic.

What changed

• Encrypted vault for credentials (AES-256-GCM) with atomic writes + lockfile coordination; key is loaded from OPENCODE_VAULT_KEY or generated locally.
• Multi-record credential store (supports multiple accounts per provider/namespace) + idempotent migration from legacy files.
• Provider auth registry/adapters (Anthropic/OpenAI/Google/Copilot/Qwen/Cursor) to unify OAuth flows and apply auth headers.
• Fetch middleware that:
  • rotates on 429 (Retry-After-aware) and retries in the same request
  • refreshes on 401/403 where supported
  • persists pool ordering + cooldowns across runs
• MCP OAuth state moved into the credential store.
• Tests for vault/store and rotation behavior; see specs/provider-auth-v2.md for the RFC/architecture.

How to test

• opencode auth login → add OAuth creds; opencode auth list should show records.
• Trigger a 429/auth_expired scenario and verify it rotates to the next credential and retries.
• Run: bun test packages/opencode/test/credentials and bun test packages/opencode/test/inference/rotating-fetch.test.ts

Follow-ups

• UI + rotation stats: auth v2 credential ui #5743
• Opt-in model discovery: auth v2 model discovery #5744
• Vault key management commands: auth v2 vault cli #5745

[rekram1-node]

this appears to be spam, if it isnt then say so and we can discuss in an issue

[jroth1111]

Not spam — sorry for the noise.

I recreated these auth-v2 PRs from a new GitHub account after losing access to the prior one, which I realize can look suspicious.

I opened an issue to discuss direction first: #5748 (includes a summary + links to the split PRs/RFC). Happy to proceed however you'd prefer (issue-first, smaller PRs, or close them entirely).