feat(libCallApi): implement OAuth2 Option A for remote API auth

[hmmftg]

Summary

Implements OAuth2 Option A for outbound remote API authentication in libCallApi using golang.org/x/oauth2 behind the existing AuthSystem / TokenCache abstractions.

Changes

• Add OAuth2Auth adapter with client_credentials and refresh_token support
• Refactor AuthSystem to use context.Context and add refresh-first logic in handleToken
• Add EnsureAuthorization and wire it into PrepareCall, ConsumeRestApi, and ConsumeRestBasicAuthApi
• Bootstrap OAuth auth from remoteApis.auth.grant-type at app startup
• Accept both auth-uri and auth-url secure param keys
• Add unit/integration tests for token fetch, cache, refresh, concurrency, and BasicAuth fallback
• Document remote API OAuth2 config in README

Config example

remoteApis:
  partner-api:
    domain: https://api.partner.com
    name: partner-api
    auth:
      grant-type: client_credentials
      auth-uri: https://auth.partner.com/oauth/token
      client-id: partner-client

Secure values: remote-api#partner-api#client-secret, client-id, auth-uri

Test plan

• go test ./libCallApi/... — all tests pass
• go build ./... — compiles cleanly