feat: anaconda OAuth support (draft snapshot)

[nichmor]

Summary

Draft snapshot of in-progress Anaconda OAuth support. Posted as a placeholder so the work isn't lost; not ready for review or merge.

This branch builds on the OAuth login infrastructure being prepared in a separate (smaller, mergeable) PR for prefix.dev OAuth login. Once that lands and Anaconda's server-side bits are sorted out, this branch will be rebased and the Anaconda-specific changes will be cleaned up into a focused follow-up PR.

What this contains

On top of the OAuth login + storage + refresh + upload-side wiring shared with the prefix.dev branch, this snapshot has the Anaconda-specific scaffolding:

• ANACONDA_OAUTH_SCOPES constant (openid email profile offline_access)
• default_oauth_config_for_host branches for anaconda.org and anaconda.com (with the auth.anaconda.com identity provider, registered client ID, and fixed redirect URI)
• fetch_provider_metadata_lenient — a targeted workaround for Anaconda's OIDC discovery doc, which omits subject_types_supported and id_token_signing_alg_values_supported
• The auth.anaconda.com host check in discover_endpoints

Known gaps before this can land

1. Token-for-API-key exchange step is missing. Anaconda's OAuth access tokens are not accepted by conda.anaconda.org directly — they need to be exchanged for a long-lived API key via Anaconda's api/auth/api-keys endpoint, then stored as Authentication::CondaToken(...). The exchange-step machinery is not yet implemented on this branch.
2. No tests against a real Anaconda OAuth flow. The host detection and discovery-doc workaround have unit tests; the end-to-end flow has not been exercised.
3. Dependency on the OAuth login infrastructure PR landing first.

Test plan

• Rebase onto the prefix.dev OAuth login PR once it merges
• Implement OAuth → API key exchange step
• Test full flow against anaconda.org and anaconda.com
• Add integration test using a mock Anaconda OAuth + API-keys endpoint
• Verify the stored credential is Authentication::CondaToken, not Authentication::OAuth

🤖 Generated with Claude Code