fix: expand configured provider values during discovery

[Brian Krabach (bkrabach)]

What changed

Provider discovery and login now expand an independent copy of the complete configured provider settings once, before deriving constructor arguments. This preserves saved per-instance values and ensures constructor kwargs and config use the same expanded values without mutating the caller's settings. The shared environment-expansion helper now lives in a lightweight module so the provider loader can use it without importing runtime configuration and creating a cycle.

This fixes the configured-provider inventory regression (#362). Existing runtime credential validation and provider/SDK fallback behavior are unchanged; unset placeholders still normalize to empty values in this loader, and the change does not claim to validate credentials.

Why

The discovery path previously derived partial constructor values and could miss environment-backed settings in saved provider instances, so provider models <instance> could fail or return the wrong inventory even when runtime configuration was available.

How to verify

• Focused regression suite: 201 passed.
• Full unit suite: 2,524 passed, 1 skipped, 13 deselected, 1 documented xfail.
• Independent Linux installed-wheel qualification: 2,521 passed, 4 skipped, 13 deselected, 1 existing xfail; installed-wheel integration: 13 passed, 2,526 deselected.
• Isolated real OpenAI inventory check passed with 35 models in 0.863s, including gpt-6-astra and gpt-6.1-sol; no credential values are included here.
• Ruff checks and Python 3.11 compilation passed. Astra and Fable reviewed the final patch and approved it for PR.

CI results will be reported separately against this commit SHA. The independent qualification skips were for unavailable macOS kqueue, production hook/logging tooling, and real tmux; the review noted cross-platform CI as a caveat.

Breaking changes

None.