Let the machine's own CLI refresh an expired token, and retry once

A 401 from the usage endpoint means the stored access token has expired.
Refreshing it here is not an option: Anthropic's OAuth rotates the refresh
token, so a second refresher invalidates the CLI's copy and forces a
re-login on a machine that usually has a live session on it. So run the CLI
there instead and re-read what it wrote.

`doctor` rather than `auth status`: probed against 2.1.258 with an invalid
token, `auth status` answers loggedIn:true from the file alone and never
reaches the network. The same probe showed a failed refresh blanks both
tokens, which is why this stays on the 401 path.

Also gives ProviderConfig one program() so the CLI's default path is not
written down twice.

server/src/session/claude.rs

@@ -392,7 +392,7 @@ impl ClaudeDriver {
         let stdout = create_log(&session_dir.join(STDOUT_LOG))?;
         let stderr = create_log(&session_dir.join(STDERR_LOG))?;
 
-        let program = provider.command.as_deref().unwrap_or("claude");
+        let program = provider.program();
         let launch = Launch::new(program, args, meta.cwd.as_deref());
         let child = transport.spawn(
             &launch,

server/src/session/llama.rs

@@ -145,7 +145,7 @@ impl LlamaDriver {
             }
         }
 
-        let program = provider.command.as_deref().unwrap_or("llama-server");
+        let program = provider.program();
         let launch = Launch::new(program, args, meta.cwd.as_deref()).reaching(forward);
         // Its output goes to files, not pipes. Not only so the process can
         // outlive this server: nothing ever read those pipes, so a chatty