auth: clean-break named [auth.<name>] sessions + extra_headers

Replace provider-level api_key/api_key_env_var with named auth sessions:
providers now reference `auth = "<name>"` and credentials live under
`[auth.<name>]`. Adds the libpanto auth type surface (AuthConfig, TokenSet,
ResolvedCredential), a Header type and provider `extra_headers`, and rewires
the CLI config loader (parse [auth.<name>], require auth=, providers always
survive, eager api_key resolution). Updates the shipped default config.

1 files changed, 18 insertions, 0 deletions

diff --git a/libpanto/src/config.zig b/libpanto/src/config.zig
index 7e1e8e1..09aaec8 100644
--- a/libpanto/src/config.zig
+++ b/libpanto/src/config.zig
@@ -26,6 +26,16 @@ pub const APIStyle = enum {
     anthropic_messages,
 };
 
+/// A single HTTP request header (name/value). Used for provider
+/// `extra_headers` — caller-supplied headers merged onto a provider's
+/// built-in request headers (e.g. GitHub Copilot's editor-identity headers,
+/// or auth-derived headers from an OAuth exchange). Borrowed slices; valid
+/// as long as the owning config is.
+pub const Header = struct {
+    name: []const u8,
+    value: []const u8,
+};
+
 /// Reasoning intensity hint sent to providers that support it.
 ///
 /// `.default` omits the field entirely so the provider's own default applies.
@@ -70,6 +80,11 @@ pub const OpenAIChatConfig = struct {
     model: []const u8,
     reasoning: ReasoningEffort = .default,
     max_tokens: u32 = 64_000,
+    /// Caller-supplied request headers merged onto the built-in ones
+    /// (content-type/accept/authorization). Used for provider identity
+    /// headers and auth-exchange-derived headers. Empty by default.
+    /// Borrowed; valid as long as this config is.
+    extra_headers: []const Header = &.{},
 };
 
 pub const AnthropicMessagesConfig = struct {
@@ -113,6 +128,9 @@ pub const AnthropicMessagesConfig = struct {
     /// history so prefixes are never reused. There the 1.25x write is pure
     /// overhead with no read to amortize it.
     prompt_cache: bool = true,
+    /// Caller-supplied request headers merged onto the built-in ones. See
+    /// `OpenAIChatConfig.extra_headers`. Empty by default.
+    extra_headers: []const Header = &.{},
 };
 
 /// Per-provider transport/auth/model configuration. Tagged by `APIStyle`.