fix(daemon): stop leaking API keys via URL query params (H2/H3)

[sudhirverma]

Summary

• Stop putting provider API keys in URLs (H2/H3 / AAP-82835): Gemini discovery uses x-goog-api-key (same as @ai-sdk/google) instead of ?key=
• /api/discover-models/:engineId accepts keys only via X-Api-Key or JSON body (POST); ?apiKey= is rejected with HTTP 400
• Dashboard wizard/discover calls send keys in header/body (POST), never URLSearchParams
• CI gate npm run check:no-query-secrets bans ?key=, query.apiKey, and params.set('apiKey' regressions in production sources
• Documented as DR-035 (MCP keeps DR-033/034 on main) (+ CONFIGURATION / ARCHITECTURE / TESTING / lean-ci updates)

Changes

• engines.ts / unit test: Gemini fetchModels header auth; assert URL does not contain the key
• server.ts: reject query apiKey; prefer X-Api-Key then body; keep non-secret baseUrl / providerId
• index.html: discover-models via POST + X-Api-Key / JSON body
• scripts/check-no-query-secrets.js + package.json / CI workflow / lean-ci skill
• Integration: discover-models-auth.test.ts (reject query, accept header/body, preference order)

Test plan

• npm run lint
• npm test
• npm run ci:build (or equivalent local gate before push)
• Manual: GET/POST /api/discover-models/gemini?apiKey=… → 400
• Manual: X-Api-Key or JSON { "apiKey": "…" } → discovery succeeds (with valid key)
• Manual: dashboard provider wizard discover does not put key in the request URL
• Confirm OpenAI /v1 tools passthrough from feat(openai-compat): opt-in tools passthrough for /v1 #78 still works after rebase onto main

Fix: https://redhat.atlassian.net/browse/AAP-82835

[cidrblock]

Maintainer pass to bring this up to speed with current main (post-#72/#78):

• Rebased onto main (was CONFLICTING)
• Renumbered this decision to DR-035 — MCP already owns DR-033/034
• Kept MCP + http-security + discover-models rows in TESTING.md
• Tightened check-no-query-secrets patterns (query['apiKey'], params.append, searchParams.set('key')
• Accept X-Api-Key when Express presents the header as string[]
• Dropped unrelated package-lock.json churn; restored from main
• Local: tsc, engines + discover-models-auth tests, npm run check:no-query-secrets green

Tip: 3e62bda. Waiting on CI, then will approve if green.

[cidrblock]

Verdict: merge-ready

H2/H3 fix looks good: Gemini uses x-goog-api-key, discover-models rejects query keys, dashboard/CI gate cover the regression class, and tests pass.

Maintainer rebase onto current main is in 3e62bda (DR-035 so MCP keeps 033/034). CI green. Approving.