refactor: unify OAuth bearer header construction across call sites

Extracted OAUTH_BETA_FLAG and FILES_API_BETA_FLAG constants in src/constants.ts and introduced buildOAuthBearerHeaders in src/headers/oauth-bearer.ts.

The helper takes (accessToken, { extraBetas?, includeOauthBeta? }) and emits:
  authorization: Bearer <token>
  anthropic-beta: <oauth-2025-04-20, ...extraBetas>

src/cli/status-api.ts:buildOAuthStatusHeaders is now a two-line delegate.

src/commands/handlers/files.ts routes both getFilesAuth and the POST /v1/files upload through the helper with extraBetas: [FILES_API_BETA_FLAG]. The 'oauth-2025-04-20,files-api-2025-04-14' string is no longer duplicated across two call sites in files.ts.

src/fingerprint/schema.ts uses the OAUTH_BETA_FLAG constant for the fallback requiredBaseBetas.

src/commands/handlers/betas.ts keeps its help-text literal unchanged — that is human-facing UI output listing preset betas, not wire-header logic.

ANTHROPIC_AUTH_TOKEN (the mixed-trust sibling noted in the review) was already deleted in commit 09f0374 (C1).

Resolves desloppify cluster oauth-header-unification (3 findings). 210/210 tests in tests/regression/fingerprint, tests/unit/request, tests/unit/fingerprint pass.