fix(auth): surface real auth errors, stop test suite wiping dev credentials

[nathanclevenger]

What broke

A user reported the SDK "wasn't working correctly with auth." Root-causing found three distinct bugs:

1. Every auth failure rendered as ✖ 401: [object Object]

The auth middleware returns { status, error: { message } } while every other endpoint returns { error: string }. src/core/client.ts assumed the flat shape, so the object became the error message. Any invalid/expired/revoked credential produced [object Object] across CLI, programmatic SDK (err.message), and MCP tools — hiding the server's actual explanation ("Authentication required. Get your API key at …").

After:✖ 401: Authentication required. Get your API key at https://auto.dev/dashboard/api-keys (verified against the live API).

2. First run with no credentials crashed with a raw stack trace

resolveAuth threw a plain Error; the command factory only formats AutoDevError and rethrew everything else. A brand-new user's first command dumped a Node stack trace instead of the login hint.

After:✖ 401: No API key found + Set AUTODEV_API_KEY or run: auto login. The factory also formats any unexpected error as a fallback (e.g. offline fetch failed).

3. pnpm test logged the developer out of auto.dev (!)

The clearCredentials test (test/auth/auth-origin-headers.test.ts) ran the real implementation against the module-level default storage: it POSTed a live token revocation to id.org.ai with the developer's stored access token, then deleted ~/.id.org.ai/token and ~/.oauth.do/token. Harmless in CI (no credentials there — the test even says so), destructive on any dev machine. Confirmed by planting a dummy token in a sandbox HOME and watching the suite delete it.

After:test/setup.ts sandboxes HOME/USERPROFILE into a fresh temp dir for every vitest run, and the test also mocks fetch so no revoke can escape. Forensic re-check: planted token survives the full suite.

Verification

• 144/144 tests pass (5 new regression tests: nested + flat + empty error shapes, typed no-credential error, formatted unexpected errors)
• tsc --noEmit clean, tsup build clean
• Live-API smoke: invalid key and no-credential paths show the new output; happy path unchanged (success branch untouched)

Known gaps left open (not this PR)

• docs.auto.dev/v2/cli-mcp-sdk claims credentials are "shared across CLI, SDK, and MCP", but new AutoDev({}) never reads the stored auto login token — doc or SDK should change (follow-up issue)
• tco returns 404 for VINs that resolve on every other endpoint — API-side, not auth

🤖 Generated with Claude Code