Support OpenChamber authentication (Bearer client token) for remote OpenCode servers #33

Problem

opencode-mcp currently supports only HTTP Basic auth (OPENCODE_SERVER_USERNAME / OPENCODE_SERVER_PASSWORD) via buildBasicAuthHeader() in src/client.ts, used by buildSdkClient() and the /global/health probe in src/server-manager.ts.

This breaks when the OpenCode server is fronted by OpenChamber (a self-hosted web UI that proxies an OpenCode backend under /api/*). OpenChamber's auth layer rejects Authorization: Basic ... outright (401 Authentication required) and instead accepts:

• a session cookie (oc_ui_session, browser-only), or
• a bearer client token: Authorization: Bearer oc_client_...

A client token is obtained by exchanging the UI password once:

POST {origin}/auth/session
Content-Type: application/json

{
  "password": "...",
  "issueClientToken": true,
  "trustDevice": true,
  "clientLabel": "opencode-mcp",
  "clientKind": "mobile",      // free-form label OpenChamber stores per client
  "dedupeKey": "<stable-id>"   // re-using it replaces the prior token for the same logical client
}

Response: { "authenticated": true, "clientToken": "oc_client_...", "client": {...} }.

With trustDevice: true the token's TTL is OpenChamber's trusted-device session TTL (default 7 days, configurable server-side via OPENCHAMBER_UI_TRUSTED_SESSION_TTL_DAYS). GET /auth/session with a bearer token returns { authenticated: false, locked: true } (401) once the token is invalid/expired/revoked. Login attempts are rate-limited (10/5min by default, lockout after that).

Right now there's no way to point opencode-mcp at such a server: Basic auth is rejected, and there's no bearer-token support at all.

Proposed change

Add two independent auth paths, additive to the existing Basic auth:

1. Static bearer token — OPENCODE_SERVER_TOKEN: sent as Authorization: Bearer <token> on the SDK client, raw fetches, and the health probe. Useful for a pre-minted OpenChamber client token (or any other bearer-auth-fronted server).
2. OpenChamber password login — OPENCODE_OPENCHAMBER_PASSWORD (+ optional OPENCODE_OPENCHAMBER_URL for the OpenChamber origin, defaulting to the origin derived from OPENCODE_BASE_URL): on first request, POST to /auth/session with issueClientToken: true, cache the returned clientToken in memory, and use it as a bearer token thereafter. On a 401, re-login once and retry the failed request before giving up.

Auth precedence: bearer token (static or OpenChamber-derived) wins over Basic if both are somehow configured; otherwise behavior is unchanged for existing Basic-auth users.

Happy to open a PR implementing this if the general direction looks right.