Validate provider access tokens before auth

[sylvesterkaczmarek]

Summary

Reject malformed access-token values from dynamic credential providers before constructing an HTTP Authorization header.

AccessTokenAuth currently trusts the string returned by TokenCache.get_token() and immediately constructs:

Authorization: Bearer <token>

A custom credential provider can return an empty token or a token with surrounding whitespace. In the empty case the SDK produces Authorization: Bearer , which can be rejected later by the HTTP stack as an invalid header value. The resulting protocol/API connection error obscures the actual problem: the credential provider returned an invalid token.

Fix

Validate the token immediately before applying it to the request.

The auth adapter now requires:

• a string token;
• a non-empty token;
• no surrounding whitespace.

Invalid provider output raises a clear AnthropicError before any Authorization header is added.

Caller-supplied static credentials retain their existing precedence.

Regression coverage

Adds sync and async tests covering invalid provider tokens, valid tokens, OAuth beta-header injection, and static Authorization bypass.