Anthropic subscription access via the companion's claude CLI login

[BunsDev]

Subscription-based Anthropic access without importing OAuth tokens onto the device.

Scope:

• Route requests through the companion daemon's signed-in claude CLI (engine ClaudeCliProvider delegating to the binary)
• Never import or replay CLI OAuth tokens on-device: bearer_auth_is_usable rejects tokens minted for other clients, and replays get rate limited — on-device Anthropic stays API-key only
• Provider picker shows the companion-backed option only while paired and reachable

Depends on remote session attach.

ROADMAP.md: M2; see the boundary note in SpikeView and f311fca.

[BunsDev]

Tracked as bead pocket-d3u in .beads (bd show pocket-d3u).