Issue a short-lived access token for a provider-hosted picker

Return the raw access token for an OAuth2 credential so the frontend can initialize a provider-hosted picker (e.g. Google Drive Picker).

GET /{provider}/credentials/{cred_id} deliberately strips secrets (see CredentialsMetaResponse + TestGetCredentialReturnsMetaOnly in router_test.py). That hardening broke the Drive picker, which needs the raw access token to call google.picker.Builder.setOAuthToken(...). This endpoint carves a narrow, explicit hole: the caller must own the credential, it must be OAuth2, and the endpoint returns only the access token + its expiry — nothing else about the credential. SDK-default credentials are excluded for the same reason as get_credential.