feat: support ANTHROPIC_AUTH_TOKEN for bearer-auth Anthropic gateways

[Steven Robbins (grumpydev)]

What & why

Some Anthropic-compatible gateways authenticate with an Authorization: Bearer <token> header rather than Anthropic's x-api-key. OpenWiki could only send x-api-key, so those gateways returned 401 unauthorized even with a valid token — and there was no first-class way to configure a bearer token (ChatAnthropic also refuses to construct without an API key, so the CLI prompted for credentials on every launch).

This adds native support for ANTHROPIC_AUTH_TOKEN.

Changes

• ANTHROPIC_AUTH_TOKEN is now a managed env var — persisted to ~/.openwiki/.env and shown (masked, like other secrets) in the credential diagnostics panel.
• API key no longer required for gateway auth — when ANTHROPIC_BASE_URL and ANTHROPIC_AUTH_TOKEN are both set, ANTHROPIC_API_KEY is not required (getMissingProviderEnvKey waives it), so there's no setup prompt every run. resolveConfiguredProvider also auto-selects anthropic from that pair.
• Headers set accordingly — the token is passed as a bearer credential via clientOptions.authToken. With no API key set, a createClient hook builds the client so only the bearer header is sent (no bogus x-api-key). Setting both ANTHROPIC_API_KEY and ANTHROPIC_AUTH_TOKEN sends both headers.
• Docs — new "Alternative base URLs" paragraph + example for the bearer-token gateway setup.
• Adds @anthropic-ai/sdk@^0.103.0 as a direct dependency (matches @langchain/anthropic's own range; needed for the createClient hook). pnpm dedupes to a single 0.103.0.

How tested

• test/constants.test.ts: API-key waiver when base URL + auth token present (and still-required when only one is present), provider auto-detection, and resolveProviderAuthToken trimming/blank handling.
• test/create-model.test.ts: bearer-only wiring (client built with authToken and a null apiKey, so no x-api-key), both-headers case, and the unchanged api-key-only case.
• pnpm run typecheck, prettier --check, and eslint pass on the changed files; the changed-area test suites are green (124/124). Note: the model-construction tests assert the resolved client config without firing a network request, matching the existing create-model.test.ts pattern.