When a resource in agent-token mode returns a 401 with an
AAuth-Requirement header containing a resource-token, the proxy now
escalates to the PS — exchanges the resource token for an auth token
and retries the call. If the PS needs consent it returns a 202
interaction that is surfaced to the caller.

Adds unit tests covering the retry path, the PS-consent interaction
path, and the plain-401 (no-challenge) pass-through.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>