Implement async OAuth token handling

[woksin]

User need

A Python client must authenticate to an authentication-enabled Chronicle kernel without making callers manage bearer-token refresh for each call.

Desired behavior

Provide an async token provider for Chronicle's OAuth client-credentials endpoint and an internal gRPC metadata path that obtains the current token for each new call.

Acceptance evidence

• Sends application/x-www-form-urlencoded fields grant_type=client_credentials, client_id, and client_secret to /connect/token.
• Parses access_token and handles an absent expires_in conservatively.
• Caches and refreshes tokens before expiry without duplicate concurrent refreshes.
• Adds authorization: Bearer <token> to each new gRPC call.
• Never logs or includes secrets or tokens in exceptions and representations.
• Separates development self-signed-certificate handling from production certificate validation.
• Tests cover success, malformed responses, authorization failure, expiry, refresh, cancellation, and concurrent callers.

Non-goals

• Defining deployment-specific scopes, audiences, authorities, or credentials.
• Disabling production certificate or hostname validation by default.

[woksin]

Sequence after #2 so token handling consumes accepted connection options.

[woksin]

Before accepting the network/authentication public API, reconcile any corrections from the @einari maintainer review in #14.

[cratis-stagehand]

Thanks for opening this - it has been received and will be looked at.

---

Posted by Stagehand (AI) - an autonomous agent, not a person. Review accordingly.