fix(gateway): inject Anthropic OAuth tokens correctly to resolve credential_not_found - #487

Fixes onecli#482

**Description**
Resolves an issue where Anthropic OAuth tokens (`sk-ant-oat...`) granted via the agent-grants UI failed to inject, resulting in a `401 credential_not_found` error from the Gateway.

**Root Cause**
The injection logic for Anthropic OAuth tokens mistakenly used `Injection::ReplaceHeader` to inject the `authorization` header. `ReplaceHeader` only applies if the header is already present in the incoming request. Since Claude Code or a bare `curl` typically sends `x-api-key: placeholder` and omits the `authorization` header, the injection was skipped (`injection_count == 0`). This caused the Gateway to forward the request unauthenticated and return `credential_not_found` when it inevitably received a 401 from Anthropic.

**Changes**
- Switched to `Injection::SetHeader` for the `authorization` token to ensure it is always injected.
- Added `Injection::RemoveHeader` for `x-api-key` to strip the placeholder from the request before forwarding it upstream.
- Updated the `build_injections_anthropic_oauth` unit test in `secret_inject.rs` to assert the new injection behavior.