Add renewable token providers to the Web API client - #3

FmsgClient requires an API key today, so an OAuth adapter cannot supply separate, renewable Web API credentials. Accept a caller-bound TokenProvider alongside the existing API-key string, with a documented provider-neutral contract. The MCP executable retains its current API-key setup; hosted OAuth discovery, validation and token exchange remain follow-up work.

The client shares concurrent renewal, pins the authenticated address, cancels acquisition when all waiters cancel or the client closes, and bounds renewal time even if a provider ignores cancellation. Short-lived tokens use a capped refresh margin. Late 401 responses reuse an already renewed token, while protected requests still retry at most once and preserve upstream denials. HTTP and WebSocket helpers use the same credential source.

The provider contract records the upstream requirement that exchanged messaging tokens must not inherit owner key-management privileges. Scope and identity authorization stay in the Web API. Fixture tests exercise credential delivery and isolation; they do not claim OAuth conformance or real-IdP compatibility.

Validation:

• Typecheck, build and all 101 tests pass locally, including 20 provider tests.
• npm package dry-run includes provider JavaScript, declarations and documentation.
• CI passed: Node 22/24, Docker image and real two-host acceptance. Docker is unavailable locally.