refactor(auth): centralize inference-credential routing in CredentialAuthority

One authority answers 'which credential may ride this request':
credential_class / manager_for / credential_for / bearer_resolver_for,
keyed by (platform, base_url). SessionCredential is an opaque type with
no production constructor, so a new call site cannot re-introduce the
session-bearer leak. Platform-scoped tests extended across all bearer
channels (session, aux, summary, subagent override).

Verified: cargo check --workspace --all-targets clean; kigi-shell and
kigi-tui suites green (6611+ tests).

crates/codegen/kigi-shell/src/agent/subagent/tests/rest.rs

@@ -2545,8 +2545,9 @@ async fn subagent_override_first_party_model_still_gets_primary_token() {
 /// (`subagent_override_non_oauth_model_still_gets_primary_token`), which encoded
 /// the defect.
 ///
-/// Revert-to-red: dropping the `platform_takes_session_credential` term from
-/// `oauth_registry::session_key_for_endpoint` makes `api_key` `Some("kimi-secret")`.
+/// Revert-to-red: make `CredentialAuthority::governing_manager`'s
+/// `Some(platform) => None` arm return `self.primary.clone()` and `api_key`
+/// becomes `Some("kimi-secret")`.
 #[tokio::test]
 async fn subagent_override_api_key_platform_never_gets_the_primary_token() {
     let (_kd, manager) = kimi_primary_with_token("kimi-secret");