vision: OAuth-from-keychain fallback for macOS Claude Code users

[abe238]

Summary

Makes `bambu vision watch` Just Work™ for users who already have Claude Code installed on macOS — no API key paste required.

Credential resolution

`ClaudeVisionProvider` now resolves credentials in this order, first hit wins:

1. Explicit `api_key=` argument
2. `ANTHROPIC_API_KEY` env var (regular API key)
3. `ANTHROPIC_AUTH_TOKEN` env var (OAuth bearer)
4. macOS only: `Claude Code-credentials` keychain entry → `claudeAiOauth.accessToken`

Option 4 is read on demand via the `security` command, never written to disk, never logged. Falls through cleanly on any failure (missing entry, wrong format, non-Mac).

Verified live

Ran `bambu vision classify` against a real captured A1-mini frame with no env vars set:

```
$ bambu vision classify /tmp/bambu-frames/current-print-...jpg --model claude-haiku-4-5
classification: unknown
confidence: 30.00%
is_failure: False
cost: $0.0022
reasoning: Frame is at an oblique angle with poor lighting and significant
glare on the build plate, making it impossible to clearly assess
layer quality, extrusion state, or print geometry.
```

(That "unknown" verdict is actually correct — the captured frame is a wide-angle workspace shot, not a print-bed view. The model honestly admitted it couldn't tell. Better frames during an active print will give crisper verdicts.)

Tests

• 12 new tests in `tests/vision/test_credentials.py` covering precedence + every failure path of the keychain reader (non-Mac, missing `security` binary, nonzero exit, non-JSON blob, missing keys, happy path).
• Modified the existing `test_missing_api_key_raises_runtime_error` to block the keychain fallback so the test works platform-independently.
• New `test_oauth_token_from_keychain_used_when_no_env_var` confirms the provider passes `auth_token=` (not `api_key=`) when the keychain branch fires.
• 51 tests passing locally; pre-commit + ruff + gitleaks clean.

Caveat

Using Claude Code's OAuth token spends the same Claude account's quota as Claude Code itself. Heavy vision use during normal coding sessions can rate-limit both. For unattended long-running prints, a separate `ANTHROPIC_API_KEY` is still the right call. Documented in `docs/vision.md`.