AuthManager: token response without access_token yields a literal 'Bearer None' header

[jschuller]

Surfaced during the mypy adoption review (#9): in AuthManager.get_headers() the OAuth branch formats f"{self.token_type} {self.token}" where both are Optional[str]. A 200 token response that omits access_token (malformed proxy, misconfigured provider) would send a literal Bearer None Authorization header downstream instead of raising a clear error at the token step.

Tiny hardening: after _store_token_response, raise ValueError when access_token is absent. Pre-existing behavior, low urgency — deliberately kept out of the v0.6.1 type-only/mypy change set.