fix(auth): align fallback API key format with test setup

Update the deterministic fallback API key to use hyphens instead of
underscores so generated keys match the expected format.

Also set API_KEY_SECRET in unit tests that exercise API key creation to
ensure consistent resolver behavior under test.

src/shared/services/apiKeyResolver.ts

@@ -39,6 +39,6 @@ export async function getOrCreateApiKey(apiKeyId?: string | null): Promise<strin
     return keyRecord.key as string;
   } catch {
     // Fallback: generate a deterministic key if DB write fails
-    return `sk_${machineId}_fallback_${Date.now()}`;
+    return `sk-${machineId}-fallback-${Date.now()}`;
   }
 }

tests/unit/guide-settings-route.test.ts

@@ -51,6 +51,7 @@ test.beforeEach(async () => {
   // Force XDG_CONFIG_HOME so resolveOpencodeConfigPath resolves to our dummy dir
   // (CI runners often have XDG_CONFIG_HOME set, causing path mismatch)
   process.env.XDG_CONFIG_HOME = path.join(DUMMY_HOME, ".config");
+  process.env.API_KEY_SECRET = "test-secret";
   await fs.mkdir(path.dirname(QWEN_CONFIG_PATH), { recursive: true }).catch(() => {});
 });
 

tests/unit/qwen-api-key-auto-create.test.ts

@@ -26,6 +26,7 @@ const originalHomedir = os.homedir;
 
 test.beforeEach(async () => {
   process.env.DATA_DIR = DUMMY_HOME;
+  process.env.API_KEY_SECRET = "test-secret";
   os.homedir = () => DUMMY_HOME;
   await fs.mkdir(DUMMY_HOME, { recursive: true }).catch(() => {});
   // Initialize DB