fix(auth): add multi-layer auth injection for desktop app compatibility

Desktop app sets OPENCODE_SERVER_PASSWORD which activates basicAuth on
the server, but the SDK client provided to plugins lacks auth headers.
The previous setConfig-only approach may silently fail depending on SDK
version.

Add belt-and-suspenders fallback chain:
1. setConfig headers (existing)
2. request interceptors
3. fetch wrapper via getConfig/setConfig
4. mutable _config.fetch wrapper
5. top-level client.fetch wrapper

Replace console.warn with structured log() for better diagnostics.

src/shared/opencode-server-auth.test.ts

@@ -53,24 +53,194 @@ describe("opencode-server-auth", () => {
     process.env.OPENCODE_SERVER_PASSWORD = "secret"
     delete process.env.OPENCODE_SERVER_USERNAME
 
-    let receivedConfig: { headers: Record<string, string> } | undefined
+    let receivedHeadersConfig: { headers: Record<string, string> } | undefined
     const client = {
       _client: {
-        setConfig: (config: { headers: Record<string, string> }) => {
-          receivedConfig = config
+        setConfig: (config: { headers?: Record<string, string> }) => {
+          if (config.headers) {
+            receivedHeadersConfig = { headers: config.headers }
+          }
         },
       },
     }
 
     injectServerAuthIntoClient(client)
 
-    expect(receivedConfig).toEqual({
+    expect(receivedHeadersConfig).toEqual({
       headers: {
         Authorization: "Basic b3BlbmNvZGU6c2VjcmV0",
       },
     })
   })
 
+  test("#given server password #when injecting wraps internal fetch #then wrapped fetch adds Authorization header", async () => {
+    //#given
+    process.env.OPENCODE_SERVER_PASSWORD = "secret"
+    delete process.env.OPENCODE_SERVER_USERNAME
+
+    let receivedAuthorization: string | null = null
+    const baseFetch = async (request: Request): Promise<Response> => {
+      receivedAuthorization = request.headers.get("Authorization")
+      return new Response("ok")
+    }
+
+    type InternalConfig = {
+      fetch?: (request: Request) => Promise<Response>
+      headers?: Record<string, string>
+    }
+
+    let currentConfig: InternalConfig = {
+      fetch: baseFetch,
+      headers: {},
+    }
+
+    const client = {
+      _client: {
+        getConfig: (): InternalConfig => ({ ...currentConfig }),
+        setConfig: (config: InternalConfig): InternalConfig => {
+          currentConfig = { ...currentConfig, ...config }
+          return { ...currentConfig }
+        },
+      },
+    }
+
+    //#when
+    injectServerAuthIntoClient(client)
+    if (!currentConfig.fetch) {
+      throw new Error("expected fetch to be set")
+    }
+    await currentConfig.fetch(new Request("http://example.com"))
+
+    //#then
+    expect(receivedAuthorization ?? "").toBe("Basic b3BlbmNvZGU6c2VjcmV0")
+  })
+
+  test("#given server password #when internal has _config.fetch but no setConfig #then fetch is wrapped and injects Authorization", async () => {
+    //#given
+    process.env.OPENCODE_SERVER_PASSWORD = "secret"
+    delete process.env.OPENCODE_SERVER_USERNAME
+
+    let receivedAuthorization: string | null = null
+    const baseFetch = async (request: Request): Promise<Response> => {
+      receivedAuthorization = request.headers.get("Authorization")
+      return new Response("ok")
+    }
+
+    const internal = {
+      _config: {
+        fetch: baseFetch,
+      },
+    }
+
+    const client = {
+      _client: internal,
+    }
+
+    //#when
+    injectServerAuthIntoClient(client)
+    await internal._config.fetch(new Request("http://example.com"))
+
+    //#then
+    expect(receivedAuthorization ?? "").toBe("Basic b3BlbmNvZGU6c2VjcmV0")
+  })
+
+  test("#given server password #when client has top-level fetch #then fetch is wrapped and injects Authorization", async () => {
+    //#given
+    process.env.OPENCODE_SERVER_PASSWORD = "secret"
+    delete process.env.OPENCODE_SERVER_USERNAME
+
+    let receivedAuthorization: string | null = null
+    const baseFetch = async (request: Request): Promise<Response> => {
+      receivedAuthorization = request.headers.get("Authorization")
+      return new Response("ok")
+    }
+
+    const client = {
+      fetch: baseFetch,
+    }
+
+    //#when
+    injectServerAuthIntoClient(client)
+    await client.fetch(new Request("http://example.com"))
+
+    //#then
+    expect(receivedAuthorization ?? "").toBe("Basic b3BlbmNvZGU6c2VjcmV0")
+  })
+
+  test("#given server password #when interceptors are available #then request interceptor injects Authorization", async () => {
+    //#given
+    process.env.OPENCODE_SERVER_PASSWORD = "secret"
+    delete process.env.OPENCODE_SERVER_USERNAME
+
+    let registeredInterceptor:
+      | ((request: Request, options: { headers?: Headers }) => Promise<Request> | Request)
+      | undefined
+
+    const client = {
+      _client: {
+        interceptors: {
+          request: {
+            use: (
+              interceptor: (request: Request, options: { headers?: Headers }) => Promise<Request> | Request
+            ): number => {
+              registeredInterceptor = interceptor
+              return 0
+            },
+          },
+        },
+      },
+    }
+
+    //#when
+    injectServerAuthIntoClient(client)
+    if (!registeredInterceptor) {
+      throw new Error("expected interceptor to be registered")
+    }
+    const request = new Request("http://example.com")
+    const result = await registeredInterceptor(request, {})
+
+    //#then
+    expect(result.headers.get("Authorization")).toBe("Basic b3BlbmNvZGU6c2VjcmV0")
+  })
+
+  test("#given no server password #when injecting into client with fetch #then does not wrap fetch", async () => {
+    //#given
+    delete process.env.OPENCODE_SERVER_PASSWORD
+    delete process.env.OPENCODE_SERVER_USERNAME
+
+    let receivedAuthorization: string | null = null
+    const baseFetch = async (request: Request): Promise<Response> => {
+      receivedAuthorization = request.headers.get("Authorization")
+      return new Response("ok")
+    }
+
+    type InternalConfig = { fetch?: (request: Request) => Promise<Response> }
+    let currentConfig: InternalConfig = { fetch: baseFetch }
+    let setConfigCalled = false
+
+    const client = {
+      _client: {
+        getConfig: (): InternalConfig => ({ ...currentConfig }),
+        setConfig: (config: InternalConfig): InternalConfig => {
+          setConfigCalled = true
+          currentConfig = { ...currentConfig, ...config }
+          return { ...currentConfig }
+        },
+      },
+    }
+
+    //#when
+    injectServerAuthIntoClient(client)
+    if (!currentConfig.fetch) {
+      throw new Error("expected fetch to exist")
+    }
+    await currentConfig.fetch(new Request("http://example.com"))
+
+    //#then
+    expect(setConfigCalled).toBe(false)
+    expect(receivedAuthorization).toBeNull()
+  })
+
   test("#given server password #when client has no _client #then does not throw", () => {
     process.env.OPENCODE_SERVER_PASSWORD = "secret"
     const client = {}