feat: secure organization provider credentials

hub/test/unit/deployment-preflight.test.ts

@@ -8,9 +8,6 @@ import {
 const VALID_ENV = {
   NODE_ENV: "production",
   DATABASE_URL: "postgresql://hub:secret@127.0.0.1:5432/hub",
-  ANTHROPIC_BASE_URL: "https://openrouter.ai/api",
-  ANTHROPIC_AUTH_TOKEN: "provider-token",
-  ANTHROPIC_API_KEY: "",
   FEISHU_APP_ID: "cli_app_id",
   FEISHU_APP_SECRET: "feishu-app-secret",
   FEISHU_BOT_OPEN_ID: "ou_bot",
@@ -82,7 +79,6 @@ describe("validateDeploymentPreflight", () => {
         input({
           env: {
             ...VALID_ENV,
-            ANTHROPIC_AUTH_TOKEN: "",
             FEISHU_APP_SECRET: "",
             HUB_PUBLIC_BASE_URL: "http://hub.example.com",
             HUB_SESSION_SECRET: "short",
@@ -93,7 +89,6 @@ describe("validateDeploymentPreflight", () => {
       expect(error).toBeInstanceOf(DeploymentPreflightError);
       expect((error as Error).message).toMatchInlineSnapshot(`
         "deployment preflight failed:
-        - ANTHROPIC_AUTH_TOKEN is required
         - FEISHU_APP_SECRET is required
         - HUB_PUBLIC_BASE_URL must use https
         - HUB_SESSION_SECRET must contain at least 32 characters"
@@ -107,11 +102,11 @@ describe("validateDeploymentPreflight", () => {
     );
   });
 
-  it("rejects a non-empty ANTHROPIC_API_KEY that would conflict with auth-token mode", () => {
+  it("rejects legacy process-global provider settings instead of silently ignoring them", () => {
     expect(() =>
       validateDeploymentPreflight(
-        input({ env: { ...VALID_ENV, ANTHROPIC_API_KEY: "conflicting-api-key" } }),
+        input({ env: { ...VALID_ENV, ANTHROPIC_AUTH_TOKEN: "global-secret" } }),
       ),
-    ).toThrow("ANTHROPIC_API_KEY must be present and empty");
+    ).toThrow("ANTHROPIC_AUTH_TOKEN must not be set");
   });
 });