refactor(provider): use AuthService in auth flows

Point ProviderAuth persistence at AuthService instead of going back through the legacy Auth facade. Add a focused test that exercises the provider auth API path and confirms credentials still persist correctly.

packages/opencode/src/provider/auth.ts

@@ -1,4 +1,6 @@
 import { Instance } from "@/project/instance"
+import { runtime } from "@/effect/runtime"
+import { AuthService } from "@/auth/service"
 import { Plugin } from "../plugin"
 import { map, filter, pipe, fromEntries, mapValues } from "remeda"
 import z from "zod"
@@ -9,6 +11,10 @@ import { Auth } from "@/auth"
 import { ProviderID } from "./schema"
 
 export namespace ProviderAuth {
+  function set(key: string, info: Auth.Info) {
+    return runtime.runPromise(AuthService.use((service) => service.set(key, info)))
+  }
+
   const state = Instance.state(async () => {
     const methods = pipe(
       await Plugin.list(),
@@ -94,7 +100,7 @@ export namespace ProviderAuth {
 
       if (result?.type === "success") {
         if ("key" in result) {
-          await Auth.set(input.providerID, {
+          await set(input.providerID, {
             type: "api",
             key: result.key,
           })
@@ -109,7 +115,7 @@ export namespace ProviderAuth {
           if (result.accountId) {
             info.accountId = result.accountId
           }
-          await Auth.set(input.providerID, info)
+          await set(input.providerID, info)
         }
         return
       }
@@ -124,7 +130,7 @@ export namespace ProviderAuth {
       key: z.string(),
     }),
     async (input) => {
-      await Auth.set(input.providerID, {
+      await set(input.providerID, {
         type: "api",
         key: input.key,
       })

packages/opencode/test/provider/auth.test.ts

@@ -0,0 +1,20 @@
+import { afterEach, expect, test } from "bun:test"
+import { Auth } from "../../src/auth"
+import { ProviderAuth } from "../../src/provider/auth"
+import { ProviderID } from "../../src/provider/schema"
+
+afterEach(async () => {
+  await Auth.remove("test-provider-auth")
+})
+
+test("ProviderAuth.api persists auth via AuthService", async () => {
+  await ProviderAuth.api({
+    providerID: ProviderID.make("test-provider-auth"),
+    key: "sk-test",
+  })
+
+  expect(await Auth.get("test-provider-auth")).toEqual({
+    type: "api",
+    key: "sk-test",
+  })
+})