Authenticate with a bearer token and custom headers when using gateways #122

Goal

Corporate and third-party gateways in front of the Messages API expect Authorization: Bearer and may require extra headers. They often use a private CA. Claude Code reads ANTHROPIC_AUTH_TOKEN, ANTHROPIC_BASE_URL, ANTHROPIC_CUSTOM_HEADERS (one Name: value per line), and NODE_EXTRA_CA_CERTS. oxide-code reads ANTHROPIC_BASE_URL and OX_EXTRA_CA_CERTS, and sends API keys only through x-api-key.

Acceptance criteria

• ANTHROPIC_AUTH_TOKEN sends Authorization: Bearer using the API-key request shape. It omits the OAuth beta and keeps the attribution block unless CLAUDE_CODE_ATTRIBUTION_HEADER=0, because strict gateways reject agentic requests that lack the block.
• ANTHROPIC_CUSTOM_HEADERS adds each configured header to every request. Malformed lines fail at startup and report the line number. Auth headers cannot be overridden.
• The CA bundle variable is documented. Either oxide-code also honors NODE_EXTRA_CA_CERTS, or the guide instructs users to set OX_EXTRA_CA_CERTS.
• Wiremock tests assert the exact headers sent for each auth mode.