Function resolve_access_token 

pub async fn resolve_access_token(
    provider: &str,
    source: &CredentialSource,
    cache: &TokenCache,
    http: &Client,
) -> Result<String, String>

Provider-aware token resolution honoring the credential source — the single entry point both the Anthropic and the OpenAI/codex paths use. (#158 C4)

• Local: refresh the provider’s own local credential (ensure_fresh_*).
• Remote: fetch a short-lived access token from the broker, keyed by provider. Reuses the caller’s http client (no per-call pool — A5), and never holds a refresh token / never writes auth.json (invariant 1).