fix(opencode): write auth.json in opencode's real schema + proxy fixes for Gemini/GPT

[dgokeeffe]

Cherry-picks the still-relevant parts of #79 (@mpkrass7) onto current main. Merging that branch wholesale would have reverted a lot — it predates main's SP-OAuth token resolution, proxy tracing, mtime-invalidated token cache, the opus-4-8 catalog with 1M context limits, and the enterprise_config.npm_env wiring.

1. auth.json was the wrong shape (real bug on main)

opencode stores credentials as a discriminated union on type; the API-key variant keeps the secret in key:

export class Api extends Schema.Class<Api>("ApiAuth")({
    type: Schema.Literal("api"),
    key: Schema.String,
    ...
}) {}

const _Info = Schema.Union([Oauth, Api, WellKnown])
    .annotate({ discriminator: "type", identifier: "Auth" })

_{opencode, packages/opencode/src/auth/index.ts}

api_key is not a field opencode recognises, and both sides wrote it:

• setup_opencode.py → {"databricks": {"api_key": ...}}
• cli_auth._update_opencode() → rotated api_key every ~10 min

So the credential was unloadable, and every rotation updated a key nothing reads.

Why nobody noticed: the two were consistently wrong — the old tests asserted api_key explicitly — and OpenCode routes through the content-filter proxy, which injects a fresh bearer per request and masks the broken credential at runtime.

The shape now lives once in utils.opencode_api_credential() / is_opencode_api_credential(), shared by writer and rotator. That's what stops the drift recurring, rather than just fixing both call sites — same reasoning as the existing workspace_sync_dest() helper. Rotation is now also scoped to type == "api", so oauth/wellknown credentials can't have a PAT written into them.

2. Tool-less requests skipped sanitisation entirely (also pre-existing)

sanitize_tool_schemas() early-returned when a request had no tools, so the top-level cleanup below it — stream_options, $schema — never ran on a plain chat turn. Found by a test written for the new GPT stripping, which failed until the early return came out.

3. Proxy compatibility fixes

• Strip exclusiveMinimum, exclusiveMaximum, multipleOf, uniqueItems — Gemini 400s the whole request on these, so an unstripped key makes the tool unusable, not merely unvalidated.
• Drop minimum/maximum on type: integer only — kept for number, since over-stripping loses real constraints.
• Strip reasoning_effort/reasoningSummary for GPT-routed models only. Stripping globally would silently downgrade output on reasoning-capable models.
• Flatten Anthropic-style content arrays to a string in both message and streaming delta. Absent content stays absent rather than becoming "", so a tool-call-only message isn't turned into an empty assistant turn.

Not taken

The setup_opencode.py model-catalog rewrite (main's is newer) and the pydantic-core pin (main has 2.46.4 after #110).

Verification

535 tests pass. New tests/test_opencode_auth_schema.py holds the contract that was missing: whatever the writer emits, the real rotator must be able to rotate, with 0600 preserved. Confirmed the auth and early-return tests fail without their fixes.

⚠️ The Gemini/GPT fixes are latent while app.yaml disables Codex and Gemini (no compatible gateway endpoints). The auth.json fix is not latent — OpenCode is enabled.

Credit to @mpkrass7 for finding the auth.json schema mismatch and the Gemini/GPT request-shaping issues.