feat(auth): named provider CLI auth profiles and runtime identity

[kunkunGames]

Problem

• AgentDesk still uses one global vendor home per provider, so two Codex/Claude/Qwen/OpenCode/Grok logins cannot be bound independently and agents that share a provider cannot be told apart by profile and model.

Desired Outcome

• Unset auth_profile keeps today's global home. Named org.yaml profiles inject only the documented vendor-home env. Agents are labeled as {agent} · {provider} {model_short} · {profile}. rate_limit_cache is keyed by (provider, profile_id).

Scope

• org.yaml provider_auth_profiles catalog plus agent/channel auth_profile
• ProviderAuthProfileResolver with fail-closed unknown id/provider/home
• Spawn overlay on SessionConfig.env_vars and PreparedCommand; OpenCodeServerKey includes profile_id
• Credential detect overlay; cswap stays global/default
• agent_identity.rs formatter on peer directory, spawn logs, GET /api/agents
• Migration 0117 rate_limit_cache PK (provider, profile_id) and overlay Claude/Codex/Grok usage fetch

Non-goals

• Do not add Settings Providers panel or login-start/complete (P1)
• Do not change Discord nicknames
• Do not rewrite HOME
• Do not implement live recovery in this card

Acceptance Criteria

• Omitted auth_profile leaves spawn env identical to today's global default and identity profile is default
• Named profiles inject only the spec home-env table plus explicit env map; GROK_HOME for grok; no HOME rewrite
• Channel auth_profile overrides agent auth_profile
• Unknown id, provider mismatch, or missing required home fail spawn with no silent global fallback
• OpenCode warm-server keys with the same bin+cwd and different profile_id are distinct
• Detect finds overlay-home credentials without requiring the global home
• identity_label matches the formatter; GET /api/agents identity has no secrets
• rate_limit_cache upsert for profile work does not replace profile_id=default

Verification

• cargo fmt --all --check
• cargo test agent_identity --lib
• cargo test provider_auth_profile --lib
• Review GET /api/agents identity object against agentdesk-provider-cli-auth-profiles-spec.md

Assignment Hint

• Claude channel is implementing the frozen P0 spec and opening the git-help PR. Keep the card in requested; do not auto-resume to coder.

Related Cards / Context

• ~/PRD/repos/agentdesk/agentdesk-provider-cli-auth-profiles/
• Orca extra-account home model
• Related live-recovery work reuses agent_identity.rs