Validate auth proxy payloads at IPC and HTTP boundaries (Follow-up to #2159) #2197

Follow-up from audit issue #2159.

Scope:

• packages/auth/src/proxy/proxy-socket-client.ts: ProxyResponse frame cast.
• packages/auth/src/proxy/proxy-token-store.ts: OAuthToken response cast.
• packages/providers/src/auth/proxy/credential-proxy-oauth-handler.ts and credential-proxy-server.ts sanitized token/payload casts.
• packages/providers/src/auth/proxy/credential-store-factory.ts and refresh-coordinator.ts proxy/refresh compatibility casts.

Root cause:
Proxy IPC and HTTP payloads are real trust boundaries, but several sites cast directly to trusted internal types instead of parsing once at the boundary.

Acceptance criteria:

• Introduce zod or existing project-standard schemas for proxy response frames, OAuthToken, sanitized token records, and proxy stats payloads where applicable.
• Parse inbound IPC/HTTP data once into trusted internal types.
• Remove direct as unknown as trusted-type casts from the audited proxy boundary sites where schemas apply.
• Preserve existing protocol behavior and error messages as much as possible.
• Add behavioral tests for malformed frames/tokens and valid payloads.
• Do not add lint suppressions or loosen lint/type rules.

References #2159.