auth: flatten [auth.<name>] config + ${...} substitution

Collapse the auth schema: infer `type` from keys, replace key/key_env_var with
a single `key` (resolved via substitution), flatten the exchange to flat
`exchange_*` keys, and drop the auth-level headers tables in favor of reusing
the provider's `extra_headers` on the auth HTTP calls. Add `${sibling}` and
`${env:VAR}` substitution over auth values (GitHub Enterprise = set `domain`).
Restore api_key-empty → provider-drop. Update default config, docs, and tests.

1 files changed, 21 insertions, 31 deletions

diff --git a/src/luarocks_runtime.zig b/src/luarocks_runtime.zig
index 3cfd02f..f0438d4 100644
--- a/src/luarocks_runtime.zig
+++ b/src/luarocks_runtime.zig
@@ -282,9 +282,12 @@ const default_base_config =
     \\# replace the lower one wholesale.
     \\#
     \\# Every networked provider names an `[auth.<name>]` session via
-    \\# `auth = "<name>"`. An api_key session whose env var is missing at
-    \\# runtime stays selectable, but its first request fails with a clear
-    \\# auth error.
+    \\# `auth = "<name>"`. An api_key session whose `${env:VAR}` is unset
+    \\# resolves to empty, and a provider with an empty key is dropped — so
+    \\# these defaults disappear unless you've exported the matching key.
+    \\#
+    \\# Values support `${...}` substitution: `${env:VAR}` reads the
+    \\# environment, `${other_key}` reads a sibling key in the same section.
     \\
     \\[providers.openai]
     \\style = "openai_chat"
@@ -292,8 +295,7 @@ const default_base_config =
     \\auth = "openai_api"
     \\
     \\[auth.openai_api]
-    \\type = "api_key"
-    \\key_env_var = "OPENAI_API_KEY"
+    \\key = "${env:OPENAI_API_KEY}"
     \\
     \\[providers.anthropic]
     \\style = "anthropic_messages"
@@ -301,8 +303,7 @@ const default_base_config =
     \\auth = "anthropic_api"
     \\
     \\[auth.anthropic_api]
-    \\type = "api_key"
-    \\key_env_var = "ANTHROPIC_API_KEY"
+    \\key = "${env:ANTHROPIC_API_KEY}"
     \\
     \\# Pick the default model with `<provider>:<alias>`. The alias is
     \\# resolved against models.toml; an unknown alias is used verbatim as
@@ -312,40 +313,30 @@ const default_base_config =
     \\# model = "anthropic:claude-sonnet-4-20250514"
     \\
     \\# GitHub Copilot subscription (OAuth device login). Run a turn against
-    \\# `copilot:<model>` and panto will guide you through device login.
+    \\# `copilot:<model>` and panto guides you through device login. The
+    \\# provider's extra_headers (the editor identity) are reused on the auth
+    \\# calls too. For GitHub Enterprise, set `domain = "company.ghe.com"`.
     \\#
     \\# [providers.copilot]
     \\# style = "openai_chat"
-    \\# base_url = "https://api.individual.githubcopilot.com"
+    \\# base_url = "https://api.individual.githubcopilot.com"   # fallback; the exchange overrides it
     \\# auth = "github_copilot"
     \\#
     \\# [providers.copilot.extra_headers]
-    \\# User-Agent = "GitHubCopilotChat/0.26.7"
-    \\# Editor-Version = "vscode/1.99.0"
-    \\# Editor-Plugin-Version = "copilot-chat/0.26.7"
+    \\# User-Agent = "GitHubCopilotChat/0.35.0"
+    \\# Editor-Version = "vscode/1.107.0"
+    \\# Editor-Plugin-Version = "copilot-chat/0.35.0"
     \\# Copilot-Integration-Id = "vscode-chat"
-    \\# X-Initiator = "user"
     \\#
     \\# [auth.github_copilot]
-    \\# type = "oauth_device"
-    \\# dialect = "token"
     \\# client_id = "Iv1.b507a08c87ecfe98"
-    \\# device_code_url = "https://github.com/login/device/code"
-    \\# token_url = "https://github.com/login/oauth/access_token"
+    \\# domain = "github.com"
+    \\# device_code_url = "https://${domain}/login/device/code"
+    \\# token_url = "https://${domain}/login/oauth/access_token"
     \\# scope = "read:user"
-    \\#
-    \\# [auth.github_copilot.exchange]
-    \\# method = "GET"
-    \\# url = "https://api.github.com/copilot_internal/v2/token"
-    \\# token_json_path = "token"
-    \\# expires_at_json_path = "expires_at"
-    \\# base_url_json_path = "endpoints.api"
-    \\#
-    \\# [auth.github_copilot.exchange.headers]
-    \\# User-Agent = "GitHubCopilotChat/0.26.7"
-    \\# Editor-Version = "vscode/1.99.0"
-    \\# Editor-Plugin-Version = "copilot-chat/0.26.7"
-    \\# Copilot-Integration-Id = "vscode-chat"
+    \\# exchange_url = "https://api.${domain}/copilot_internal/v2/token"
+    \\# exchange_expires_path = "expires_at"
+    \\# exchange_base_url_path = "endpoints.api"
     \\
     \\# OpenAI Codex via a ChatGPT subscription (device login). Codex speaks the
     \\# OpenAI Responses API, not Chat Completions, so style = "openai_responses".
@@ -362,7 +353,6 @@ const default_base_config =
     \\# originator = "codex_cli_rs"
     \\#
     \\# [auth.openai_codex]
-    \\# type = "oauth_device"
     \\# dialect = "codex"
     \\# client_id = "app_EMoamEEZ73f0CkXaXp7hrann"
     \\# device_code_url = "https://auth.openai.com/api/accounts/deviceauth/usercode"