refactor: centralize config — auth.toml for secrets, config.yaml for settings

[ajianaz]

Summary

Separate concerns: secrets in auth.toml, settings in config.yaml. Fixes #209.

Changes

Config separation

• auth.toml now stores ONLY api_key (secret)
• Provider info (provider/model/base_url) moved to ~/.cora/config.yaml
• Auto-migration: existing auth.toml provider info → config.yaml on first run

CORA_API_KEY for CI

• Restored CORA_API_KEY env var support (read by clap --api-key flag)
• Used primarily for CI — local dev uses cora auth login → auth.toml

config show improvements

• cora config show — shows fully merged effective config
• cora config show --global — shows ~/.cora/config.yaml only
• cora config show --project — shows .cora.yaml only

config set writes to correct location

• cora config set --global provider zai → writes to ~/.cora/config.yaml
• cora config set provider zai → writes to .cora.yaml (project)

File Roles

File	Contents	Used by
~/.cora/auth.toml	api_key ONLY	Local dev
~/.cora/config.yaml	provider, model, base_url, focus, hook, output, etc.	Global default
.cora.yaml	Per-project config overrides	Project + CI
CORA_API_KEY env var	API key for CI	CI only

Test Plan

• All unit tests pass
• cora config show shows zai (from config.yaml)
• cora config show --global shows config.yaml contents
• cora config show --project shows .cora.yaml or "not found"
• cora review --stream sends to zai (glm-5.1) correctly
• auth.toml migration strips provider info, keeps only api_key
• CORA_API_KEY env var works for CI

Closes #209