feat(auth): active credential health prober

[warelik]

Summary

• Add credential-prober config block (opt-in, default OFF).
• Implement conductor_prober.go periodic loop in sdk/cliproxy/auth.
• Probe uses the existing ProviderExecutor.HttpRequest with resolved base URLs and canonical protocol headers (e.g. Claude Anthropic-Version: 2023-06-01 and Anthropic-Beta: oauth-2025-04-20 on OAuth credentials).
• 2xx responses (including empty body, 204, or empty 200) are treated as probe success (health signal, not empty payload failure).
• Failures (non-2xx, timeouts, network faults) are fed directly into Manager.MarkResult so they reuse the existing cooldown/suspension machinery (no second source of truth).
• Rate-limited by rate-limit-per-minute, concurrency-limited by max-concurrency, and timeout-gated by timeout.
• Prober start/stop is decoupled from configCooldownMu / setConfigSnapshotLocked to prevent deadlock risks.
• Minimal touches to conductor.go (prober lifecycle fields) and conductor_cooldown.go (start/stop on config update); no changes to cooldown knobs.
• Tests cover disabled-by-default, disabled-auth skipping, failure cooldown, success, empty/204 2xx responses, Claude headers, and concurrency/config update deadlock safety.

Relates to #211, #218.