feat(ai): apiKey: false for keyless providers - #60770

Problem

A provider that needs no key (a local server, a gateway that authenticates by header) had no way to say so. Leaving the key out failed with Missing auth credential: apiKey, and passing apiKey: false crashed.

Change

apiKey: false means "no key on purpose": no env lookup, no auth header from the package, no error. Omitted or "" keeps today's behavior.

OpenAICompatible.model("local", { apiKey: false, baseURL: "http://127.0.0.1:8080/v1" })
OpenAICompatible.configure({ apiKey: false, baseURL, headers: { "x-gateway-token": "t" } }) // sends only that header

 AuthOptions.apiKey(options, envVars, apply)   // new shared helper; bearer() wraps it
   auth override?        -> use it
+  apiKey === false      -> Auth.none
   else                  -> apiKey ?? env vars, rendered by apply

Covered: every provider on the shared helper (OpenAI, OpenAI-compatible chat/responses, xAI, Groq, DeepSeek, OpenRouter, Vercel AI Gateway, Cloudflare Workers AI, Mistral, Cohere, Alibaba, Moonshot, MiniMax, Z.ai, Meta, Venice, etc.), plus Anthropic and Anthropic-compatible (x-api-key), Google (x-goog-api-key), Azure (api-key), Cloudflare AI Gateway, ElevenLabs, Deepgram and AssemblyAI. Image, decision and other media routes reuse the same auth, so they honor it too.

Out of scope

• Amazon Bedrock (SigV4/bearer) and Google Vertex (ADC/express): auth unchanged, and their types still reject apiKey: false.
• Core config wiring: Configured credentialless providers require an empty API key #42790

Verification

• New offline test/keyless-auth.test.ts against a local Bun.serve stub: omitted key still errors; apiKey: false succeeds with no Authorization (chat + image) and no x-api-key (Anthropic); custom header is the only one sent.
• Type tests in test/auth-options.types.ts.
• bun test in packages/ai (2000 pass), bun typecheck + typecheck:tsc in ai and core, bun run check.

Added by the opencode bot (AI-generated).

Related: #42790

Public API: @opencode/ai: provider apiKey options accept false; adds AuthOptions.apiKey helper and AuthOptions.ApiKey type (backwards compatible)