refactor: centralize config — auth.toml for secrets only, config.yaml for settings

[ajianaz]

Summary

Centralize config architecture so each file has a single clear responsibility. Make setup simple for both local dev and CI.

Current Problem

• auth.toml stores both secret (api_key) AND non-secret settings (provider, model, base_url)
• Config scattered across 5 places (auth.toml, config.yaml, .cora.yaml, env vars, CLI flags)
• cora config show does not read auth.toml provider info — shows wrong values
• CI uses CORA_API_KEY env var but we removed that from code — CI will break
• cora auth login writes provider info to auth.toml but config show ignores it
• No way to quickly inspect global vs project config separately

Proposed Architecture

File Roles

File	Contents	Used by
~/.cora/auth.toml	api_key ONLY (secret)	Local dev
~/.cora/config.yaml	provider, model, base_url, focus, hook, output, etc.	Global default
.cora.yaml	Per-project config overrides	Project + CI
CORA_API_KEY env var	API key for CI/one-shot	CI only

API Key Resolution (new)

1. CLI flag --api-key           (one-shot)
2. CORA_API_KEY env var         (CI / one-shot)
3. ~/.cora/auth.toml api_key    (local dev)
4. Provider env vars            (OPENAI_API_KEY, ZAI_API_KEY, etc — fallback)

Provider/Model/Base URL Resolution (new)

1. CLI flags --provider/--model/--base-url   (one-shot)
2. CORA_* env vars                           (CI override)
3. .cora.yaml (project)                      (project config)
4. ~/.cora/config.yaml (global)              (global config)
5. Auto-detect from provider env vars        (fallback)
6. Built-in defaults                         (openai/gpt-4o-mini)

Tasks

Phase 1: Config separation

• Remove provider/model/base_url from auth.toml — only api_key stays
• cora auth login saves api_key to auth.toml, provider info to ~/.cora/config.yaml
• Auto-migrate existing auth.toml provider info → config.yaml
• cora config show reads from config.yaml + auth.toml (merged)
• cora config show --global shows only global config
• cora config show --project shows only project config

Phase 2: CORA_API_KEY restore for CI

• Bring back CORA_API_KEY env var support (read-only, for CI)
• Update build_llm_config to check CORA_API_KEY as CI fallback
• Update auth_status to report CORA_API_KEY when set
• Update CI action to only need CORA_API_KEY (provider/model from .cora.yaml)

Phase 3: CI & docs

• Update .github/actions/cora-review/action.yml — remove CORA_BASE_URL/CORA_MODEL inputs
• Update docs/configuration.md with new architecture
• Update cora init template — remove provider section from .cora.yaml template
• Update cora providers output messages

Phase 4: Pre-commit hook as default

• cora init installs pre-commit hook by default (already done, verify)
• Ensure hook runs cora review --staged with correct config resolution
• Test hook works with new config architecture

Breaking Changes

• auth.toml no longer stores provider info (auto-migrated)
• cora auth login writes to config.yaml instead of auth.toml for provider settings
• CI action inputs change (simplified)

Migration

Existing users with provider info in auth.toml → auto-migrated to config.yaml on first run.