Add an async bearer-auth step with background token refresh

[OmarAlJarrah]

Problem

There's no async auth step, and token refresh blocks the caller even when the current token is still valid.

Proposed change

Add an async bearer-auth step. Implement background refresh: if the token is valid but near expiry, return it immediately and refresh off-thread. Add a default fetchAsync on the token provider. Keep per-cloud token providers (GCP/Azure/K8s) and OAuth token-exchange specifics out of sdk-core — those belong in adapter modules.

Prior art: openai-java's workload-identity auth does background refresh (WorkloadIdentityAuth.kt).

Acceptance

• Async auth step
• Valid-but-expiring token returned without blocking
• Tests

Dependencies

• Related Evict a bearer token on a 401 challenge instead of waiting for the expiry margin #33 — same bearer auth step

---

Priority: medium · Effort: medium