feat(oci/auth): session-token disk reload + last_refresh_error observability (v0.2.0b14)

[fede-kamel]

Audit-driven follow-up to b13. Closes two gaps against the oci-genai-auth reference (oracle-samples/oci-genai-auth-python).

Why

Session-token profiles (the ~/.oci/config shape with security_token_file = ...) are the standard laptop-dev auth mode. SecurityTokenSigner from the OCI SDK is immutable, so after b13's periodic refresh wiring landed, session-token signers were still effectively static: when oci session refresh rotated the file out-of-band, the next request still used the original captured token and 401'd until the process restarted.

The other gap: when refresh fails (DNS hiccup, metadata-service flake, file race), the wrapper swallowed the exception silently. Operators had no way to spot "this pod has been failing every refresh attempt for the last 30 minutes and is one 401 away from going dark."

What changed

• Session-token disk reload. _refresh_callable_for(signer, *, profile=..., config_file=...) in openai_compat.py now, for a SecurityTokenSigner, returns a closure that re-reads security_token_file from disk and yields a fresh signer. OCIRequestSigner._do_refresh detects the returned signer (via hasattr(result, "do_request_sign")) and swaps self._signer to it. Both OCIOpenAIModel and OCIResponsesModel plumb the new args through.
• last_refresh_error observability. Exposed publicly on OCIRequestSigner; reset to None on every successful refresh; structured log emit (warning on failure, debug on success) so pod logs show the refresh outcome.
• Refresh callback contract widened. Callback can now optionally return a new signer instance instead of mutating the current one. Backwards-compatible: existing in-place mutators (instance/resource principal refresh_security_token) still work, since they typically return None.

Test plan

• 9 new unit cases in test_oci_signer_refresh_observability.py — covering the new last_refresh_error attribute, both refresh-callback return-value shapes, in-place-mutation backward compat, end-to-end session-token disk round-trip with a temp keypair, and the guard paths that disable refresh when profile context is missing.
• ruff / mypy / codespell / markdownlint / commitizen all pass
• Smoke-tested manually: real SecurityTokenSigner built from a tempfile, file rotated, refresh callable produces a fresh signer carrying the new token.

Ships as v0.2.0b14. CHANGELOG entry under that heading.