fix(cli): recognize OAuth credentials in startup gate

[shixi-li]

Summary

• Make the interactive startup gate validate credentials for the provider that actually owns the configured model, using one config snapshot for routing and inline credentials.
• Reuse oauth-cli-kit's Codex storage contract, including its existing Codex CLI credential import, and require every field Raven needs to send a request.
• Recognize LiteLLM's cached GitHub Copilot credentials without starting a device flow or refreshing at startup.
• Bind raven agent --config readiness checks to the same config file used by the runtime.
• Fail closed for missing, malformed, expired, or unrelated credentials while preserving API-key behavior.

Type

• Fix
• Feature
• Docs
• CI / tooling
• Refactor
• Other

Verification

• Relevant tests pass locally
• Relevant lint / type checks pass locally
• User-facing docs or screenshots are updated when needed

Commands run:

uv run --no-project --python 3.12 --with pytest==9.0.3 --with pytest-asyncio==1.3.0 --with typer==0.23.1 --with click==8.1.8 --with rich==14.3.4 --with 'pydantic>=2.12,<3' --with 'pydantic-settings>=2.14,<3' --with 'httpx>=0.28,<1' --with 'loguru>=0.7,<1' --with 'platformdirs>=4,<5' --with 'tiktoken>=0.7,<1' --with 'pyyaml>=6' --with 'croniter>=6,<7' --with 'tomli-w>=1.2' --with 'questionary>=2,<3' --with 'watchfiles>=0.21,<2' --with 'portalocker>=3.2' --with 'orjson>=3.11,<4' --with oauth-cli-kit==0.1.6 --with litellm==1.85.0 pytest tests/test_cli_onboard_commands.py tests/test_config_update_providers.py tests/test_cli_provider_commands.py tests/test_tui_rpc_model.py -q
uv run --no-project --python 3.12 --with ruff==0.15.11 ruff check raven/cli/agent_commands.py raven/cli/onboard_commands.py raven/config/update_providers.py tests/test_cli_onboard_commands.py tests/test_config_update_providers.py tests/test_tui_rpc_model.py
uv run --no-project --python 3.12 --with ruff==0.15.11 ruff format --check raven/cli/agent_commands.py raven/cli/onboard_commands.py raven/config/update_providers.py tests/test_cli_onboard_commands.py tests/test_config_update_providers.py tests/test_tui_rpc_model.py
uv build --no-sources

The full frozen environment could not be materialized on the macOS x86_64 host because lancedb==0.33.0 has no compatible wheel. The focused tests ran in an isolated uv environment with the locked OAuth, CLI, and test tool versions, and the package build completed separately. The checkout did not contain the prebuilt ui-tui/dist/entry.js, so the local wheel build succeeded without the bundled TUI asset; this existing release-asset condition is outside the Python startup-gate diff.

Risk

• Security impact considered
• Backward compatibility considered
• Rollback path is clear for risky changes

Credential checks are local and offline and return only a boolean status; token fields are never returned or logged. Routing and API-key/local status derive from a single raw config snapshot, while OAuth reads only the separate credential stores. Codex delegates loading and legacy import to oauth-cli-kit, requires the account id Raven sends as a header, and treats an expired access token with a refresh token as refresh-capable. Copilot mirrors the locked LiteLLM access-token and API-key cache paths and environment overrides without instantiating its directory-writing authenticator. Tests cover malformed and missing fields, expiry types, expired caches, secret non-disclosure, single-read behavior, selected and forced routing, API-key setups, both agent --config directions, TUI/agent entry points, provider commands, and the TUI RPC consumer.

Related Issues

Closes #218