feat(proxy): resolve auth_v2 OAuth client secret via the secret manager

The RFC 7662 introspection client secret was read straight from config. Resolve
it through litellm's get_secret_str at introspection time so it can live in a
secret manager (or env ref) instead of plaintext config; a literal value passes
through unchanged. Resolved in _introspect rather than at settings load so the
secret-manager lookup never runs in can_handle for non-OAuth tokens.

mypy clean on 23 files, 141 tests green.

litellm/proxy/auth/v2/authn/authenticators.py

@@ -258,13 +258,25 @@ class OAuth2IntrospectionAuthenticator:
         import base64
 
         from litellm.llms.custom_httpx.http_handler import get_async_httpx_client
+        from litellm.secret_managers.main import get_secret_str
         from litellm.types.llms.custom_http import httpxSpecialProvider
 
         # RFC 7662 client auth is HTTP Basic; the shared handler's post() takes
-        # headers, not an auth tuple, so build the header explicitly.
+        # headers, not an auth tuple, so build the header explicitly. Resolve the
+        # client secret through the secret manager here (not at settings load, which
+        # runs in can_handle) so it is never required to sit in plaintext config;
+        # a literal value passes through unchanged.
         headers = {}
         if settings.client_id:
-            credentials = f"{settings.client_id}:{settings.client_secret or ''}"
+            secret = ""
+            if settings.client_secret:
+                secret = (
+                    get_secret_str(
+                        settings.client_secret, default_value=settings.client_secret
+                    )
+                    or ""
+                )
+            credentials = f"{settings.client_id}:{secret}"
             headers["Authorization"] = (
                 "Basic " + base64.b64encode(credentials.encode()).decode()
             )