auth: clean-break named [auth.<name>] sessions + extra_headers

Replace provider-level api_key/api_key_env_var with named auth sessions:
providers now reference `auth = "<name>"` and credentials live under
`[auth.<name>]`. Adds the libpanto auth type surface (AuthConfig, TokenSet,
ResolvedCredential), a Header type and provider `extra_headers`, and rewires
the CLI config loader (parse [auth.<name>], require auth=, providers always
survive, eager api_key resolution). Updates the shipped default config.

1 files changed, 54 insertions, 8 deletions

diff --git a/src/luarocks_runtime.zig b/src/luarocks_runtime.zig
index 7f01c19..ac34ee0 100644
--- a/src/luarocks_runtime.zig
+++ b/src/luarocks_runtime.zig
@@ -267,9 +267,10 @@ fn stageAgentTree(
 }
 
 /// The default base `config.toml`, materialized at `$PANTO_HOME/config.toml`
-/// on first run if absent. It declares OpenAI and Anthropic providers whose
-/// API keys come from the conventional env vars — so a provider simply
-/// doesn't appear unless its key is exported. Edit or override at the user
+/// on first run if absent. It declares OpenAI and Anthropic providers, each
+/// naming an `[auth.<name>]` session whose key comes from the conventional
+/// env var — so a provider's first request fails with a clear auth error
+/// unless its key is exported. Edit or override at the user
 /// (`~/.config/panto/config.toml`) or project (`./.panto/config.toml`) layer.
 const default_base_config =
     \\# panto base config (auto-generated on first run).
@@ -280,19 +281,28 @@ const default_base_config =
     \\# Tables merge across layers; scalars and arrays from a higher layer
     \\# replace the lower one wholesale.
     \\#
-    \\# A provider whose API key (or its api_key_env_var) is missing at
-    \\# runtime is silently dropped — so these defaults disappear unless
-    \\# you've exported the corresponding key.
+    \\# Every networked provider names an `[auth.<name>]` session via
+    \\# `auth = "<name>"`. An api_key session whose env var is missing at
+    \\# runtime stays selectable, but its first request fails with a clear
+    \\# auth error.
     \\
     \\[providers.openai]
     \\style = "openai_chat"
     \\base_url = "https://api.openai.com/v1"
-    \\api_key_env_var = "OPENAI_API_KEY"
+    \\auth = "openai_api"
+    \\
+    \\[auth.openai_api]
+    \\type = "api_key"
+    \\key_env_var = "OPENAI_API_KEY"
     \\
     \\[providers.anthropic]
     \\style = "anthropic_messages"
     \\base_url = "https://api.anthropic.com"
-    \\api_key_env_var = "ANTHROPIC_API_KEY"
+    \\auth = "anthropic_api"
+    \\
+    \\[auth.anthropic_api]
+    \\type = "api_key"
+    \\key_env_var = "ANTHROPIC_API_KEY"
     \\
     \\# Pick the default model with `<provider>:<alias>`. The alias is
     \\# resolved against models.toml; an unknown alias is used verbatim as
@@ -301,6 +311,42 @@ const default_base_config =
     \\# [defaults]
     \\# model = "anthropic:claude-sonnet-4-20250514"
     \\
+    \\# GitHub Copilot subscription (OAuth device login). Run a turn against
+    \\# `copilot:<model>` and panto will guide you through device login.
+    \\#
+    \\# [providers.copilot]
+    \\# style = "openai_chat"
+    \\# base_url = "https://api.individual.githubcopilot.com"
+    \\# auth = "github_copilot"
+    \\#
+    \\# [providers.copilot.extra_headers]
+    \\# User-Agent = "GitHubCopilotChat/0.26.7"
+    \\# Editor-Version = "vscode/1.99.0"
+    \\# Editor-Plugin-Version = "copilot-chat/0.26.7"
+    \\# Copilot-Integration-Id = "vscode-chat"
+    \\# X-Initiator = "user"
+    \\#
+    \\# [auth.github_copilot]
+    \\# type = "oauth_device"
+    \\# dialect = "token"
+    \\# client_id = "Iv1.b507a08c87ecfe98"
+    \\# device_code_url = "https://github.com/login/device/code"
+    \\# token_url = "https://github.com/login/oauth/access_token"
+    \\# scope = "read:user"
+    \\#
+    \\# [auth.github_copilot.exchange]
+    \\# method = "GET"
+    \\# url = "https://api.github.com/copilot_internal/v2/token"
+    \\# token_json_path = "token"
+    \\# expires_at_json_path = "expires_at"
+    \\# base_url_json_path = "endpoints.api"
+    \\#
+    \\# [auth.github_copilot.exchange.headers]
+    \\# User-Agent = "GitHubCopilotChat/0.26.7"
+    \\# Editor-Version = "vscode/1.99.0"
+    \\# Editor-Plugin-Version = "copilot-chat/0.26.7"
+    \\# Copilot-Integration-Id = "vscode-chat"
+    \\
     \\# Tool/extension availability (glob patterns). Empty allow = allow all.
     \\# [tools]
     \\# allow = ["std.*"]