refactor(providers): move auth status checks into provider runtimes

Move provider authentication status logic out of the CLI auth route so auth checks
live with the provider implementations that understand each provider's install
and credential model.

Add provider-specific auth runtime classes for Claude, Codex, Cursor, and Gemini,
and expose them through the shared provider contract as `provider.auth`. Add a
provider auth service that resolves providers through the registry and delegates
status checks via `auth.getStatus()`.

Keep the existing `/api/cli/<provider>/status` endpoints, but make them thin route
adapters over the new provider auth service. This removes duplicated route-local
credential parsing and makes auth status a first-class provider capability beside
MCP and message handling.

server/shared/types.ts

@@ -155,3 +155,25 @@ export type UpsertProviderMcpServerInput = {
   bearerTokenEnvVar?: string;
   envHttpHeaders?: Record<string, string>;
 };
+
+// ---------------------------------------------------------------------------------------------
+
+// -------------------- Provider auth status types --------------------
+/**
+ * Result of a provider status check (installation + authentication).
+ *
+ * installed - Whether the provider's CLI/SDK is available
+ * provider - Provider id the status belongs to
+ * authenticated - Whether valid credentials exist
+ * email - User email or auth method identifier
+ * method - Auth method (e.g. 'api_key', 'credentials_file')
+ * [error] - Error message if not installed or not authenticated
+ */
+export type ProviderAuthStatus = {
+  installed: boolean;
+  provider: LLMProvider;
+  authenticated: boolean;
+  email: string | null;
+  method: string | null;
+  error?: string;
+};