Subscription & OAuth provider auth

Part of umbrella #10542 · Theme B (freedom of model choice) · "give choice to everyone, don't limit anyone"

Problem

Providers today assume a per-token API key. Many users already pay for a subscription (ChatGPT Plus/Team, Claude Pro/Max, Gemini Advanced, Mistral Le Chat, etc.) and want to use that — via OAuth/sign-in, not a separate billed API key. To not limit anyone, the gateway needs an auth abstraction beyond api_key: OAuth tokens, device-code flows, and session-based providers, with secure refresh.

What exists today

• llm_shared/provider_registry.py + base_provider.py — provider lifecycle, credential gating (currently key-centric).
• autobot-slm-backend/api/sso_auth.py — OAuth2 / OIDC machinery already in the platform (reuse, don't rebuild).
• Secrets/vault direction: Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) #10088 / secrets: SLM LLMSettings stores provider api_key inline — should use Secrets/vaults #10503 (credentials belong in the vault, not inline LLMSettings).
• custom_openai.py — pattern for OpenAI-compatible endpoints.

What to build

• A provider auth abstraction: ApiKeyAuth | OAuthAuth | DeviceCodeAuth | SessionAuth, with token storage in the Secrets vault and automatic refresh.
• OAuth/device-code sign-in flows for subscription providers (reuse SSO OAuth machinery).
• Settings UI: "Sign in with {provider}" alongside "paste API key" — user's choice.
• Clear per-provider capability + ToS labeling so users understand what each auth mode allows.

Acceptance criteria

• A provider can authenticate via OAuth/device-code, not just an API key (test with one subscription provider end-to-end).
• Tokens stored in the Secrets vault with refresh; never inline in LLMSettings (aligns Umbrella/PRD: unify AutoBot secrets — one RBAC-governed store, vaults + one key abstraction (replaces 11 stores, 5 keys, 2 UIs) #10088/secrets: SLM LLMSettings stores provider api_key inline — should use Secrets/vaults #10503).
• UI offers both "sign in" and "API key" where a provider supports both.
• Reuses existing SSO OAuth machinery rather than a parallel implementation.

Entry points

autobot-backend/llm_shared/base_provider.py + provider_registry.py (auth abstraction) · autobot-slm-backend/api/sso_auth.py (OAuth reuse) · Secrets vault (#10088) · settings/provider frontend.