- New config commandcode_api_key (user_... provider key, long-lived);
when set, usage queries hit /alpha/billing/credits + /alpha/usage/summary
with Bearer auth — no more 7-day session cookie rotation
- session_token kept as optional fallback (legacy /internal + cookie path)
- alpha credits lack opensourceMonthlyCredits; formatter tolerates
- alpha non-200 passes through status without echoing upstream body
- Remove AuthProvider capability declaration; keep only management_api
- Drop auth.login.start/poll and auth.identifier handlers
- Remove unused auth.parse and file-parsing structs
- Update QuotaCard version tag to v0.2.1
- Sync User-Agent to use PluginVersion