fix(auth): add opencode/opencode-zen to search pairs for credential resolution (#10892) (#10899)

Reconciliado com a release (mesmo drift de typecheck-baseline/glm.ts/fetchTimeout.ts/stryker.conf.json dos PRs irmãos) e corrigi o `no-explicit-any` no teste novo (cast tipado, mesmo padrão do repo). Validado: lint limpo, teste focado passando. Fix real (busca de credenciais opencode-zen/opencode via PROVIDER_SEARCH_PAIRS). CI vermelho é o base-red já rastreado em #9985. Obrigado!

src/sse/services/auth.ts

@@ -983,6 +983,8 @@ const PROVIDER_SEARCH_PAIRS: string[][] = [
   // The model layer canonicalizes `agy/` to `antigravity`, but the Antigravity
   // CLI card stores its connection under `agy`. Same account, either id serves.
   ["antigravity", "agy"],
+  // OpenCode connection card stores under `opencode`, but model alias resolves to `opencode-zen`.
+  ["opencode", "opencode-zen"],
   // One Jina token works on api.jina.ai, r.jina.ai, and s.jina.ai.
   // Requested id stays first so embed/rerank do not silently pick a
   // Reader-only row when both cards are filled. jina-search has no

tests/unit/opencode-autocombo-search-pair.test.ts

@@ -0,0 +1,29 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-opencode-pair-test-"));
+process.env.DATA_DIR = TEST_DATA_DIR;
+process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "opencode-pair-test-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const { getProviderCredentials } = await import("../../src/sse/services/auth.ts");
+
+test("getProviderCredentials('opencode-zen') finds active connection stored under 'opencode'", async () => {
+  const db = core.getDbInstance();
+  const now = new Date().toISOString();
+
+  // Seed an active connection under provider='opencode'
+  db.prepare(
+    `INSERT OR REPLACE INTO provider_connections
+       (id, provider, is_active, api_key, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?)`
+  ).run("opencode-conn-1", "opencode", 1, "test-opencode-key", now, now);
+
+  const creds = (await getProviderCredentials("opencode-zen")) as { apiKey?: string } | null;
+
+  assert.ok(creds, "Credentials should be returned for opencode-zen lookup");
+  assert.equal(creds!.apiKey, "test-opencode-key");
+});