feat(selectel): project-scoped IAM auth with token cache; provider Validate

Selectel Cloud DNS v2 requires a project IAM token in X-Auth-Token, not the
raw service-user secret; the previous client sent the static secret directly
and got 401. The client now parses Credentials.Secret as a Creds JSON blob
(username/password/account_id/project_name), exchanges it for a token via
the Identity API (POST /identity/v3/auth/tokens), and caches the token in
memory per-account until 5 minutes before expiry. ListZones/GetRecords/
ApplyChanges send the cached IAM token instead of the raw secret.

provider.Provider gains a Validate(ctx, Credentials) method so a bad account
can be rejected via trial login at creation time; all Provider fakes across
provider/registry/api/service test packages implement it as a no-op stub for
now (Task 2 will make api's mock configurable).

Security: the service-user password is folded into the token cache key via
SHA-256 (never stored in the clear) so a password change invalidates the
cached token; identity errors are generic and never echo the request body.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01BwxdSt4reTm7Dj1oxRvpP3

internal/api/tenant_test.go

@@ -161,6 +161,7 @@ func (mockProvider) GetRecords(context.Context, provider.Credentials, string) ([
 func (mockProvider) ApplyChanges(context.Context, provider.Credentials, string, diff.Changeset) error {
 	return nil
 }
+func (mockProvider) Validate(context.Context, provider.Credentials) error { return nil }
 
 // newTenantTestAPI wires a fixed authenticated user who owns whatever
 // project id is requested (alwaysOwnedAuthStore/alwaysValidSessions, see