Explicit credentials, login effects, and provider catalog state

Credentials are owned by a CredentialStore; login interaction is owned by a LoginIO. Reads, refreshes, writes, prompts, and notifications are explicit async operations. RhoModels owns provider selection and serialized refresh gates instead of relying on process-global auth state.