The auth-required short-circuit introduced to 'cleanly skip' providers
without credentials broke the existing resilience tests that mock
ProviderFactory.create_provider. Revert to the original behaviour where
each provider's get_instance_quotes is responsible for returning an empty
list on missing credentials. ProviderFactory.requires_auth and the
REQUIRES_AUTH class flag remain available for other callers (drift/CLI
discovery).