fix: mask API key output and clear conflicting OAuth credentials

[NianJiuZst]

Summary

• mask api_key in normal and dry-run config set output
• remove an existing OAuth block when a new API key is stored
• clear the cached region so the new key is detected against the correct host
• reject empty or whitespace-only API keys before reading or writing configuration
• keep config command tests isolated so they do not replace the loader for auth tests

Root cause

config set rendered every value verbatim, including API keys. It also wrote a new api_key without clearing OAuth, while the credential resolver prefers OAuth over the config-file API key. The command could therefore leak the secret and then silently continue using the old credential.

The first regression tests used a process-wide Bun module mock. After PR #194 added auth persistence coverage, that mock leaked into the auth tests and replaced their real temporary config loader. Empty values also remained valid and could erase a working OAuth session while saving an unusable key.

Impact

The complete key is still written to the mode-0600 config file, but terminal and CI output only receive a masked value. A successful API-key update now leaves one unambiguous credential source. Empty values fail without touching existing credentials, and the tests preserve the isolation introduced by PR #194.

Validation

• bun test — 392 passed
• targeted config and auth tests — 18 passed
• bun run typecheck
• bun run build:dev
• ESLint on all changed TypeScript files
• git diff --check