fix(auth): stop the API key placeholder from shadowing Oh My Pi /login credentials (#78)

Oh My Pi kept the unresolved $COMMAND_CODE_API_KEY placeholder as a literal config API key that shadowed its /login credential store and was sent as the Bearer token (401). The placeholder is now registered only on pi, where it keeps the API-key auth method and --api-key working next to OAuth; on OMP the provider omits apiKey unless a real key is configured. Host-supplied placeholders are resolved or stripped on every stream path, and the legacy generate transport uses the same rule.

Stored /login OAuth and API-key credentials, --api-key, and env keys are now covered end to end on both pi and Oh My Pi, and CI runs the pi suite against a real binary.

Co-authored-by: ebreen <ebreen@users.noreply.github.com>

.github/workflows/ci.yml

@@ -17,11 +17,21 @@ jobs:
       - uses: actions/checkout@v4
       - uses: actions/setup-node@v4
         with:
-          node-version: 20
+          node-version: 22
           cache: npm
       - run: npm ci
       - run: npm run typecheck
+      # `npm test` includes tests/test-pi-local.mjs, which drives a real pi
+      # binary against the mock API and otherwise skips silently.
+      - name: Install pi
+        run: |
+          npm install -g @earendil-works/pi-coding-agent@latest
+          echo "PI_BIN=$(npm prefix -g)/bin/pi" >> "$GITHUB_ENV"
+      - name: Verify pi starts
+        run: '"$PI_BIN" --version'
       - run: npm test
+        env:
+          PI_LOCAL_REQUIRED: "1"
 
   format:
     runs-on: ubuntu-latest