feat(cloud): remove static credentials and add host console

cloud-console/src/api.test.ts

@@ -3,12 +3,9 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import {
   AUTH_INVALID_EVENT,
-  clearStoredToken,
-  getStoredToken,
   listDevices,
   login,
   registerPlugin,
-  storeToken,
 } from "./api";
 
 function response(payload: unknown, status = 200): Response {
@@ -20,14 +17,12 @@ function response(payload: unknown, status = 200): Response {
 
 describe("Cloud Console API authentication", () => {
   beforeEach(() => {
-    clearStoredToken();
     document.cookie = "amcp_csrf=; Max-Age=0; path=/";
     vi.stubGlobal("fetch", vi.fn());
   });
 
   afterEach(() => {
     vi.unstubAllGlobals();
-    clearStoredToken();
   });
 
   it("uses credentialed account login without a bearer header", async () => {
@@ -79,34 +74,17 @@ describe("Cloud Console API authentication", () => {
     );
   });
 
-  it("keeps the explicit compatibility bearer-token path", async () => {
-    storeToken("compatibility-token");
-    vi.mocked(fetch).mockResolvedValueOnce(response([]));
-
-    await listDevices();
-
-    expect(fetch).toHaveBeenCalledWith(
-      expect.stringMatching(/\/v1\/devices$/),
-      expect.objectContaining({
-        headers: expect.objectContaining({ Authorization: "Bearer compatibility-token" }),
-      }),
-    );
-  });
-
-  it("clears authentication only on 401, not on 403", async () => {
-    storeToken("compatibility-token");
+  it("invalidates the session only on 401", async () => {
     const invalidated = vi.fn();
     window.addEventListener(AUTH_INVALID_EVENT, invalidated);
     vi.mocked(fetch).mockResolvedValueOnce(response({ detail: "unauthorized" }, 401));
 
     await expect(listDevices()).rejects.toMatchObject({ status: 401 });
-    expect(getStoredToken()).toBeNull();
     expect(invalidated).toHaveBeenCalledTimes(1);
 
-    storeToken("compatibility-token");
     vi.mocked(fetch).mockResolvedValueOnce(response({ detail: "forbidden" }, 403));
     await expect(listDevices()).rejects.toMatchObject({ status: 403 });
-    expect(getStoredToken()).toBe("compatibility-token");
+    expect(invalidated).toHaveBeenCalledTimes(1);
     window.removeEventListener(AUTH_INVALID_EVENT, invalidated);
   });
 });