claude auth login should defer to apiKeyHelper when configured

Context

We run Claude Code against an internal LLM gateway using apiKeyHelper (a script that prints a token) plus ANTHROPIC_BASE_URL. The helper owns authentication end-to-end: it caches a token, refreshes it, and exits 1 when the user is logged out.

Problem

claude auth status correctly reports apiKeyHelper/apiKeySource: apiKeyHelper, but when the helper exits non-zero the reported state is loggedIn: false, authMethod: none — and claude auth login only knows the built-in claude.ai OAuth flow. There is no way for Claude Code to trigger the helper's own login (in our case an Okta device-code flow), so users bounce between "Claude says log in" and "log in where?".

Proposal

When apiKeyHelper is configured, claude auth login should delegate to the helper's interactive login path — e.g. a companion setting (apiKeyLoginHelper / apiKeyHelperLogin) that Claude Code runs on claude auth login, or at minimum surface "run <helper> to authenticate" instead of starting the claude.ai flow. Happy to discuss shapes; even documented guidance ("helpers should exit 1 and auth status should point users at it") would help.