feat(auth): active credential health prober

[warelik]

Summary

• Add credential-prober config block (opt-in, default OFF).
• Implement conductor_prober.go periodic loop in sdk/cliproxy/auth.
• Probe uses the existing ProviderExecutor.HttpRequest with a lightweight GET /v1/models (configurable path) to detect dead-but-silent credentials.
• Failures are fed directly into Manager.MarkResult so they reuse the existing cooldown/suspension machinery (no second source of truth).
• Rate-limited by rate-limit-per-minute, concurrency-limited by max-concurrency, and timeout-gated by timeout.
• Minimal touches to conductor.go (prober lifecycle fields) and conductor_cooldown.go (start/stop on config update); no changes to cooldown knobs.
• Tests cover disabled-by-default, disabled-auth skipping, failure cooldown, success, and empty/204 responses.

Relates to #211, #218.