[auth] OAuth2 client follow-ups from #98 review #115

Follow-up to #98 / #68 (merged in f1137c9). Non-blocking review points from @ROHIT-JR's approval that are still open on develop @ 331bebe:

• Numeric-string expires_in. token_response_to_stored({"access_token": "a", "expires_in": "3600"}) raises "Invalid OAuth token response". Some providers send it as a string; accept numeric strings.
• Local-only revoke. revoke_token raises "endpoint configuration failed" when the provider has no revocation endpoint, and the token stays stored. Add an option to delete locally when there is no endpoint or revocation fails.
• Encrypted store re-derives its key on every read/write. PBKDF2 (100k iterations) costs ~14–28 ms per operation. Derive once in __init__; track the static salt separately.
• SecretValue for client_secret. OAuth2ClientConfig.client_secret should accept SecretValue ([auth] SecretValue wrapper for secrets #93, now on develop) and unwrap only at the point of use.
• "Get valid token" helper. Add get_access_token(key) that refreshes when needed, so refresh coalescing is used by default instead of every caller writing check-then-refresh.
• _path_locks growth / cross-process rotation. The dict grows without bound, and file locking is process-local, so two processes rotating refresh tokens can lose a rotation. At minimum bound the dict; document or fix the cross-process case.
• Move docs/oauth-client-verification.md (a point-in-time test report that will go stale) out of docs/.

~sent from claude-code