fix(server): honor OPENCODE_SERVER_USERNAME for serve and --server - #59379

Issue for this PR

Closes #45856

Type of change

• Bug fix
• New feature
• Refactor / code improvement
• Documentation

What does this PR do?

V2 hardcoded the Basic auth username to opencode on both sides, so OPENCODE_SERVER_USERNAME was ignored even though the docs describe it. As a result, opencode serve turned away the credentials the user had configured.

• Server: ServerOptions gains an optional username, and the auth config uses it (default opencode). Both createRoutes and the process dispatcher, which handles requests before boot finishes, now read it.
• Pairing session tokens are accepted with any username. The app always sends them as opencode:<token>, so a custom username would otherwise break existing pairing links. A plain password still has to come with the configured username.
• CLI:
  • Env.username reads OPENCODE_SERVER_USERNAME (default opencode).
  • --server sends that username.
  • opencode serve passes it to the server. Service and stdio/standalone modes keep opencode, because their clients (service registration, PTY handoff, standalone lease) always authenticate with the default.

Not in this PR: the app and desktop "connect with password" forms still send opencode. Fixing them needs a username field, persistence and i18n strings, so I'm leaving that for a follow-up.

How did you verify your code works?

• Ran OPENCODE_SERVER_USERNAME=testuser OPENCODE_SERVER_PASSWORD=testpass opencode serve. curl -u testuser:testpass passes auth, opencode:testpass gets 401, and session list --server with the same env works.
• Updated packages/server/test/auth.test.ts: a password needs the configured username, and a session token works with any username.
• New test in packages/cli/test/server-connection.test.ts: --server sends the configured username.
• The full packages/server suite and the related packages/cli tests pass, and bun typecheck passes in both packages.

Visual

<svg xmlns="http://www.w3.org/2000/svg" width="240" height="72" viewBox="0 0 240 72" fill="none" font-family="ui-monospace,monospace" font-size="11">
  <rect x="20" y="14" width="200" height="44" rx="8" stroke="currentColor" stroke-opacity=".35"/>
  <text x="34" y="32" fill="currentColor" opacity=".5">user</text>
  <text x="34" y="48" fill="currentColor" opacity=".5">pass</text>
  <text x="74" y="48" fill="currentColor" opacity=".8">••••••</text>
  <text x="74" y="32" fill="currentColor" opacity="0">opencode<animate attributeName="opacity" values="0;.8;.8;0;0" keyTimes="0;.1;.4;.5;1" dur="4s" repeatCount="indefinite"/></text>
  <text x="74" y="32" fill="currentColor" opacity=".9">alice<animate attributeName="opacity" values="0;0;0;.9;.9" keyTimes="0;.1;.45;.55;1" dur="4s" repeatCount="indefinite"/></text>
  <path d="M184 36l6 6 12-12" stroke="currentColor" stroke-width="2.5" stroke-linecap="round" stroke-linejoin="round" opacity=".9"><animate attributeName="opacity" values="0;0;.9;.9" keyTimes="0;.6;.7;1" dur="4s" repeatCount="indefinite"/></path>
</svg>

Checklist

• I have tested my changes locally
• I have not included unrelated changes in this PR

Added by the opencode bot (AI-generated).

Related: #49427, #46224

Public API: honours OPENCODE_SERVER_USERNAME in serve (default mode) and --server; adds optional username to ServerOptions (backwards compatible)