auth: clean-break named [auth.<name>] sessions + extra_headers

Replace provider-level api_key/api_key_env_var with named auth sessions:
providers now reference `auth = "<name>"` and credentials live under
`[auth.<name>]`. Adds the libpanto auth type surface (AuthConfig, TokenSet,
ResolvedCredential), a Header type and provider `extra_headers`, and rewires
the CLI config loader (parse [auth.<name>], require auth=, providers always
survive, eager api_key resolution). Updates the shipped default config.

1 files changed, 17 insertions, 0 deletions

diff --git a/libpanto/src/public.zig b/libpanto/src/public.zig
index 277b4ea..2ee44dd 100644
--- a/libpanto/src/public.zig
+++ b/libpanto/src/public.zig
@@ -29,6 +29,7 @@
 const std = @import("std");
 
 const config_mod = @import("config.zig");
+const auth_mod = @import("auth.zig");
 const conversation_mod = @import("conversation.zig");
 const agent_mod = @import("agent.zig");
 const stream_mod = @import("stream.zig");
@@ -69,6 +70,21 @@ pub const Effort = config_mod.Effort;
 pub const CompactionConfig = config_mod.CompactionConfig;
 pub const RetryConfig = config_mod.RetryConfig;
 pub const WireIdentity = config_mod.WireIdentity;
+pub const Header = config_mod.Header;
+
+// ===========================================================================
+// Auth (data + flows, aliased)
+// ===========================================================================
+
+pub const AuthConfig = auth_mod.AuthConfig;
+pub const AuthType = auth_mod.AuthType;
+pub const ApiKeyAuth = auth_mod.ApiKeyAuth;
+pub const OAuthDeviceAuth = auth_mod.OAuthDeviceAuth;
+pub const ExchangeConfig = auth_mod.ExchangeConfig;
+pub const DeviceDialect = auth_mod.DeviceDialect;
+pub const TokenRequestFormat = auth_mod.TokenRequestFormat;
+pub const TokenSet = auth_mod.TokenSet;
+pub const ResolvedCredential = auth_mod.ResolvedCredential;
 
 // ===========================================================================
 // Conversation construction (data, aliased)
@@ -205,6 +221,7 @@ test {
     // Internal modules' tests (not part of the public surface, but their
     // tests must still run).
     std.testing.refAllDecls(config_mod);
+    std.testing.refAllDecls(auth_mod);
     std.testing.refAllDecls(conversation_mod);
     std.testing.refAllDecls(agent_mod);
     std.testing.refAllDecls(stream_mod);