fix(mcp/v2): add the assert_never tail to resolve()'s dispatch match

resolve() is the one function the whole seam exists for, yet it ended its match on
auth_spec_kind without the assert_never tail that both sibling matches (the spike's
label_enum and CredError.summary) carry and that the module README documents as
load-bearing. The compile-time gate (reportMatchNotExhaustive) already held, so this
is defence-in-depth: without the tail a bypassed gate (a stray case _ left in, which
suppresses the exhaustiveness check) lets the match fall through and return None,
silently violating the declared Result[httpx.Auth, CredError] contract. The tail turns
that into a loud failure and brings the seam in line with the documented pattern.

litellm/proxy/_experimental/mcp_server/v2/oauth/types.py

@@ -170,6 +170,7 @@ class UpstreamCredentialProvider:
                 return self._none(subject, server)
             case AuthSpecKind.aws_sigv4:
                 return self._aws_sigv4(subject, server)
+        assert_never(server.auth_spec_kind)
 
     # --- arms: Phase 0 stubs (errors-as-values, no raise). Filled in Phase 1. -------------
     def _authorization_code(