support runtime oauth reload

[islee23520]

Summary

• Add a runtime chat.headers hook for the xAI provider so plugin-managed OAuth/API-key credentials can be resolved on each chat request.
• Refresh expired stored OAuth credentials before injecting the request Authorization header.
• Preserve OpenCode-managed auth when this plugin has no reloadable credentials, and fail closed when an expired OAuth refresh fails.
• Remove silent shell-env refresh masking: shells still stay unchanged when no plugin-managed credential exists, but expired OAuth refresh failures now surface instead of being swallowed.
• Prepare v1.1.5 release metadata and keep package/CLI/User-Agent version diagnostics in sync.
• Add regression coverage for runtime OAuth refresh, API-key header injection, OpenCode-managed auth preservation, refresh failure, non-xAI isolation, shell-env behavior, and version metadata.

Root cause

The plugin refreshed credentials through the auth loader, tools, and shell env paths, but active OpenCode chat requests could continue using headers resolved before the OAuth file expired or changed. That meant a reboot/restart recovered the session, while runtime token reload was not guaranteed.

Validation

• bun test — 24 pass, 0 fail, 83 expect() calls
• bun run typecheck
• bun run lint
• bun run build
• git diff --check
• node dist/cli.js --version → 1.1.5
• npm pack --dry-run --json → opencode-xai-oauth@1.1.5

Ready for release as v1.1.5 from fix/runtime-oauth-reload.