feat: add AuthenticationContext ambient primitive

[Kamilbenkirane]

Summary

Adds a ContextVar-backed ambient authentication primitive so multi-tenant servers can bind per-request credentials without threading auth= through every call site.

• New module-level state in celeste.auth exposing AuthenticationContext (frozen pydantic, keyed by Provider), an authentication_scope() context manager, and a resolve_authentication() helper.
• create_client() consults the ambient context as a third resolution step between explicit kwargs and env-based credentials, using the resolved model's provider as the lookup key. Explicit auth= / api_key= kwargs still win.
• New MissingAuthenticationError (subclass of CredentialsError) raised when a scope is bound but the requested provider has no entry — distinct from MissingCredentialsError so a multi-tenant caller can distinguish "scoped auth has no entry for this provider" from "env credentials are missing." Mirrors MissingCredentialsError's positional provider signature.
• Top-level re-exports: from celeste import AuthenticationContext, authentication_scope, MissingAuthenticationError.

Usage

from pydantic import SecretStr
from celeste import AuthenticationContext, authentication_scope
from celeste.core import Provider
from celeste.auth import AuthHeader

ctx = AuthenticationContext(entries={
    Provider.OPENAI: AuthHeader(secret=SecretStr(user_openai_key)),
    Provider.ANTHROPIC: AuthHeader(secret=SecretStr(user_anthropic_key)),
})

with authentication_scope(ctx):
    # Calls into openai/* models use the OpenAI auth.
    # Calls into anthropic/* models use the Anthropic auth.
    # The provider is resolved from the model id at call time.
    ...

Backward compatibility

The module-level celeste.text.generate(...) API is unchanged. Namespaces stay stateless singletons. Existing callers that pass auth= or api_key= explicitly observe identical behavior — ambient is additive and only kicks in when both kwargs are None and the resolved model's provider is known.

Why per-Provider keying

The ambient context mirrors celeste's existing internal auth model: Credentials.get_auth(provider, ...) and _auth_registry: dict[Provider, ...] in credentials.py are both keyed by Provider. Authentication instances are provider-bound by construction (AuthHeader produces provider-specific headers), so Provider is the natural identity of an auth object. Per-Provider also maps cleanly to user mental models ("my OpenAI key, my Anthropic key") and eliminates the redundancy of storing the same auth under multiple (Modality, Operation) slots when one provider serves several modalities.

For the rare edge case where a user has two different auth strategies for the same provider, the existing explicit auth= kwarg on every celeste call provides the per-call escape hatch.

Pattern precedent

Ambient per-request state backed by a ContextVar is the dominant Python idiom for libraries with module-level APIs that need request-scoped behavior — Flask g / request, Werkzeug Local, structlog bind_contextvars, OpenTelemetry's ContextVarsRuntimeContext, and DSPy's dspy.context(lm=...). This PR adopts the same pattern for celeste authentication.

Implementation notes

• AuthenticationContext is frozen because asyncio.gather siblings share a context snapshot by reference — mutability would cause silent cross-task credential bleed under concurrent requests.
• When a scope is bound but has no entry for the resolved provider, resolve_authentication raises MissingAuthenticationError — it does not fall through to env credentials, so a multi-tenant server can't accidentally charge a user's request to the process-global env key.
• Executor audit confirmed celeste has zero run_in_executor / ThreadPoolExecutor / concurrent.futures call sites, so ContextVar propagates naturally across the SDK without any copy_context() wrappers.
• The lookup in create_client() runs after resolved_provider is populated from _resolve_model().provider, so the provider is always known when the ambient is consulted (BYOA paths with resolved_provider is None skip the ambient entirely and use explicit kwargs).

Test plan

• 19 unit tests in tests/unit_tests/test_auth.py covering: existing AuthHeader / APIKey / registry tests (unchanged), frozen invariant, scope enter/exit, nested scopes, explicit-None-clears, scope-bound-but-provider-missing raises, asyncio.create_task propagation, asyncio.gather siblings, asyncio.to_thread propagation, raw ThreadPoolExecutor does-not-propagate (negative test), ThreadPoolExecutor + copy_context() does propagate.
• Full unit test suite: 598 passing, 0 regressions.
• uv run mypy src/celeste clean (331 source files).
• uv run ruff check clean, pre-commit hooks (ruff, format, mypy src+tests, bandit) all pass.

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.