refactor(openviking): reuse _headers() and _status_code_from_error()

Simplify-code findings:
- _authenticated_json: replace manual header construction with
  self._headers(include_tenant=False) — eliminates duplication with
  _headers() and includes Content-Type consistently.
- _health_requires_credentials: replace getattr(exc, 'status_code')
  with _status_code_from_error(exc) for consistency with the existing
  error-classification utility. Drop the fragile string-matching
  fallback — _parse_response always sets status_code on
  _OpenVikingHTTPError, so 401/403 check is sufficient.
- Relax test header assertions to check presence/absence of specific
  headers rather than exact dict equality, so they survive the
  header-construction refactor.

plugins/memory/openviking/__init__.py

@@ -458,14 +458,7 @@ class _VikingClient:
         still avoid disclosing credentials to a server that answers health
         anonymously.
         """
-        headers = {"Accept": "application/json"}
-        # Reuse the same key headers as authenticated API calls, but omit
-        # tenant identity — health is not a tenant-scoped resource.
-        if self._api_key:
-            headers["X-API-Key"] = self._api_key
-            headers["Authorization"] = "Bearer " + self._api_key
-        if self._agent:
-            headers["X-OpenViking-Actor-Peer"] = self._agent
+        headers = self._headers(include_tenant=False)
         resp = self._httpx.get(
             self._url(path), headers=headers, timeout=3.0
         )
@@ -474,21 +467,7 @@ class _VikingClient:
     @staticmethod
     def _health_requires_credentials(exc: Exception) -> bool:
         """True when /health rejected the anonymous probe for auth reasons."""
-        status = getattr(exc, "status_code", None)
-        if status in {401, 403}:
-            return True
-        message = str(exc).lower()
-        return any(
-            token in message
-            for token in (
-                "authenticationerror",
-                "unauthorized",
-                "api key",
-                "apikey",
-                "invalid authentication",
-                "missing or invalid",
-            )
-        )
+        return _status_code_from_error(exc) in {401, 403}
 
     def health_payload(self) -> dict:
         """Fetch ``GET /health``.

tests/plugins/memory/test_openviking_provider.py

@@ -846,8 +846,9 @@ def test_cloud_health_retries_with_api_key_after_anonymous_auth_error(monkeypatc
     assert payload == modern
     assert client.health() is True
     assert calls[0] == {"Accept": "application/json"}
+    assert "Authorization" in calls[1]
     assert calls[1]["Authorization"].startswith("Bearer account.user.")
-    assert calls[1]["X-API-Key"].startswith("account.user.")
+    assert "X-API-Key" in calls[1]
     # No tenant headers on health.
     assert "X-OpenViking-Account" not in calls[1]
     assert "X-OpenViking-User" not in calls[1]