Make Anthropic Auto prefer OAuth and keep auth-method UI accurate

Flip Anthropic Auto credential resolution to OAuth-first (Claude
subscription), matching OpenAI and user intent, and ensure every
auth-method surface mirrors the credential that requests actually use:

- get_access_token: explicit ApiKey uses the API key; Auto tries OAuth
  first and falls back to the API key.
- active_auth_method_label (MultiProvider): Auto reports OAuth when
  OAuth credentials exist, else API key.
- widget_auth_method: Auto/fallback branch prefers OAuth before API key.
- header_provider_auth_tag: honor JCODE_RUNTIME_PROVIDER explicit
  selection, then resolve Auto OAuth-first for Anthropic and OpenAI.
- update_cost: only accrue API-key cost for Anthropic when no OAuth
  credential is present (OAuth subscription has no per-token user cost).

Add header_provider_auth_tag tests for runtime selection + OAuth-first
Auto, and guard the OpenAI tag test against ambient env.