Let the machine's own CLI refresh an expired token, and retry once

A 401 from the usage endpoint means the stored access token has expired.
Refreshing it here is not an option: Anthropic's OAuth rotates the refresh
token, so a second refresher invalidates the CLI's copy and forces a
re-login on a machine that usually has a live session on it. So run the CLI
there instead and re-read what it wrote.

`doctor` rather than `auth status`: probed against 2.1.258 with an invalid
token, `auth status` answers loggedIn:true from the file alone and never
reaches the network. The same probe showed a failed refresh blanks both
tokens, which is why this stays on the 401 path.

Also gives ProviderConfig one program() so the CLI's default path is not
written down twice.

server/src/config.rs

@@ -90,6 +90,16 @@ pub struct ProviderConfig {
     pub models: Vec<String>,
 }
 
+impl ProviderConfig {
+    /// The executable to run for this provider: its override, or its kind's
+    /// default.
+    pub fn program(&self) -> &str {
+        self.command
+            .as_deref()
+            .unwrap_or(self.kind.default_program())
+    }
+}
+
 /// How to reach a setup that isn't this machine, with the system `ssh` client
 /// -- so `~/.ssh/config`, agents and jump hosts all keep working, and there is
 /// one place to configure connections. A remote session is the identical
@@ -194,6 +204,21 @@ impl DriverKind {
         }
     }
 
+    /// The executable a provider of this kind runs when it names none.
+    ///
+    /// Here rather than at each spawn site because it is not only the spawn
+    /// that runs it: `usage` runs the Claude CLI too, to have it refresh its
+    /// own OAuth token, and a default that disagreed with the driver's would
+    /// ask the wrong binary on a machine with two installs.
+    pub fn default_program(self) -> &'static str {
+        match self {
+            Self::ClaudeCli => "claude",
+            Self::LlamaCpp => "llama-server",
+            // Echo is translated in-process; nothing is spawned for it.
+            Self::Echo => "echo",
+        }
+    }
+
     /// Whether the conversation exists outside this app, so that deleting the
     /// session here does not end it.
     ///