Credential handling adds 'profile' and 'federation' as recognized auth kinds

What

Claude Code's authentication system now understands two new kinds of credentials, profile and federation, alongside the existing token and api_key kinds.

• Credential-scope matching, cache-key derivation, and on-disk cache file naming now handle profile and federation, each with their own file-name prefix and auth-description text.
• The function that maps a credential kind to an org-scoping bucket now treats profile and federation the same as token/api_key, resolving them to "orgless".
• Telemetry (including model_catalog_published and related events) now includes an auth_kind field classifying the session as one of: third_party, host_token, claudeai_login, auth_token_env, api_key_env, api_key_login, api_key_helper, profile_user_oauth, profile_federation, or none.
• Two identity-tracking classes gained a federationIdentity field (cleared on reset), though nothing in this release actually sets it to a filled value yet.

Why

This is groundwork for supporting profile-based and federated authentication methods, giving telemetry and internal logic a way to recognize and scope these credential types even before they're fully wired up.