A CLI .credentials.json placed at a provider's credentials_file loaded fine and
then reported "credentials are invalid or missing": _load_credentials() did a
bare json.load, but every reader looks for `access_token`, while the CLI schema
nests `claudeAiOauth.accessToken`. The tokens are equivalent — only the spelling
differs — so normalize on load instead of rejecting them.

ClaudeAuth.normalize_tokens() is the inverse of
ClaudeProviderHandler._oauth_tokens_to_cli_credentials(); keep the two in step.
It also carries subscriptionType/rateLimitTier across, so converting back to CLI
shape reproduces the real values rather than falling back to that function's
'pro'/'default_claude_ai' defaults. Anything already in AISBF shape is untouched.

Applied to the DB path too, which assigns auth.tokens directly and hits the
identical mismatch if a CLI blob was stored verbatim.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>