fix: Config load eagerly resolves credentials for every configured provider, not just the active one

[sam-saffron-jarvis]

What

• stop config.Load() from eagerly resolving every configured LLM provider at startup
• resolve credentials only for the default provider during load, then resolve other configured providers on demand when they are actually used
• add targeted regression tests covering the deferred gemini-cli case and on-demand resolution for non-default providers

Why

Resolving every provider on every startup makes cold start latency scale with the total number of configured providers and forces unnecessary work for unused integrations, including provider-specific credential loading like gemini-cli OAuth reads. This keeps startup fast while preserving existing behavior once a non-default provider is selected or otherwise accessed.