fix(claude): detect macOS Keychain authentication

[devswha]

Summary

• recognize Claude Code 2.x OAuth credentials stored in the macOS Keychain
• probe only Keychain item metadata and never request the secret value
• retain environment, settings.json, and legacy credentials-file precedence
• make the Claude version probe reject spawn errors and non-zero exits

Reproduction

1. Complete Claude Code 2.1.31 OAuth login on macOS
2. Confirm the Claude Code-credentials Keychain item exists
3. Request /api/providers/claude/auth/status
4. Before this change the endpoint returns authenticated:false because only the legacy credentials JSON file is inspected

Reproduced twice after a successful OAuth login.

Verification

• Claude Keychain auth tests: 3/3
• npm run typecheck
• npm run lint
• npm run build

[devswha]

E2E QA evidence (2026-07-22): Claude Code 2.1.31 completed the full two-turn lifecycle, including refresh replay without duplicates and history resume.