refactor(agent): add Session::from_source convenience constructor

Session keeps llm_client: Client as its internal model — a session is
bounded (≤ 1 hour) and its cached client stays fresh within that
window. Session::new(client, ...) remains the primitive (used by the
server-mediated agent adapter path in fabro-cli/exec.rs, which builds
a Client with a custom ProviderAdapter, no source involved).

Add Session::from_source(source, ...) for callers that hold a source
directly — resolves a Client via Client::from_source and delegates to
new. Lets workflow-level callers that store Arc<dyn CredentialSource>
build a Session without hand-resolving first.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

lib/crates/fabro-agent/src/session.rs

@@ -2,6 +2,7 @@ use std::collections::{HashMap, VecDeque};
 use std::sync::{Arc, Mutex};
 use std::time::SystemTime;
 
+use fabro_auth::CredentialSource;
 use fabro_llm::client::Client;
 use fabro_llm::error::ProviderErrorKind;
 use fabro_llm::generate::StreamAccumulator;
@@ -91,6 +92,33 @@ impl Session {
         }
     }
 
+    /// Build a session from a credential source. Resolves the LLM client
+    /// once at construction and caches it for the session's lifetime.
+    /// Sessions are bounded (≤ 1 hour); cached client is fine within that
+    /// window. For longer-lived contexts (workflow runs) hold a source,
+    /// not a session.
+    ///
+    /// # Errors
+    ///
+    /// Returns an error if `Client::from_source` fails (e.g. vault unreachable,
+    /// OAuth refresh failed).
+    pub async fn from_source(
+        source: &dyn CredentialSource,
+        provider_profile: Arc<dyn AgentProfile>,
+        sandbox: Arc<dyn Sandbox>,
+        config: SessionOptions,
+        subagent_manager: Option<Arc<AsyncMutex<SubAgentManager>>>,
+    ) -> Result<Self, LlmError> {
+        let client = Client::from_source(source).await?;
+        Ok(Self::new(
+            client,
+            provider_profile,
+            sandbox,
+            config,
+            subagent_manager,
+        ))
+    }
+
     pub fn set_tool_env(&mut self, env: HashMap<String, String>) {
         self.tool_env = Some(env);
     }