Authenticate with a long-lived OAuth token #121

Goal

claude setup-token issues a long-lived OAuth token for subscription accounts. Claude Code reads the token from CLAUDE_CODE_OAUTH_TOKEN, then skips interactive login and token refresh. This works well on headless machines, in CI, and with Nix-managed profiles that inject the token from a secret file. oxide-code currently supports API keys and the Claude Code credential store only.

Acceptance criteria

• CLAUDE_CODE_OAUTH_TOKEN authenticates using the OAuth request shape, including a Bearer token, the OAuth beta, and the billing attestation, without accessing the keychain or credentials file.
• The configuration guide documents precedence among the token, ANTHROPIC_API_KEY, and stored credentials. /status shows which source is active without revealing its value.
• A 401 response for an expired or revoked token produces an actionable error that names the variable.
• Tests cover precedence and request headers using fake tokens only.