WIP: Remove global state from pi-ai OAuth/API key handling

- Remove setApiKey, resolveApiKey, and global apiKeys Map from stream.ts
- Rename getApiKey to getApiKeyFromEnv (only checks env vars)
- Remove OAuth storage layer (storage.ts deleted)
- OAuth login/refresh functions now return credentials instead of saving
- getOAuthApiKey/refreshOAuthToken now take credentials as params
- Add test/oauth.ts helper for ai package tests
- Simplify root npm run check (single biome + tsgo pass)
- Remove redundant check scripts from most packages
- Add web-ui and coding-agent examples to biome/tsgo includes

coding-agent still has compile errors - needs refactoring for new API

packages/ai/src/utils/oauth/google-gemini-cli.ts

@@ -5,7 +5,7 @@
 
 import { createHash, randomBytes } from "crypto";
 import { createServer, type Server } from "http";
-import { type OAuthCredentials, saveOAuthCredentials } from "./storage.js";
+import type { OAuthCredentials } from "./types.js";
 
 const decode = (s: string) => Buffer.from(s, "base64").toString();
 const CLIENT_ID = decode(
@@ -22,11 +22,6 @@ const AUTH_URL = "https://accounts.google.com/o/oauth2/v2/auth";
 const TOKEN_URL = "https://oauth2.googleapis.com/token";
 const CODE_ASSIST_ENDPOINT = "https://cloudcode-pa.googleapis.com";
 
-export interface GoogleCloudCredentials extends OAuthCredentials {
-	projectId: string;
-	email?: string;
-}
-
 /**
  * Generate PKCE code verifier and challenge
  */
@@ -251,7 +246,6 @@ export async function refreshGoogleCloudToken(refreshToken: string, projectId: s
 	};
 
 	return {
-		type: "oauth",
 		refresh: data.refresh_token || refreshToken,
 		access: data.access_token,
 		expires: Date.now() + data.expires_in * 1000 - 5 * 60 * 1000,
@@ -268,7 +262,7 @@ export async function refreshGoogleCloudToken(refreshToken: string, projectId: s
 export async function loginGeminiCli(
 	onAuth: (info: { url: string; instructions?: string }) => void,
 	onProgress?: (message: string) => void,
-): Promise<GoogleCloudCredentials> {
+): Promise<OAuthCredentials> {
 	const { verifier, challenge } = generatePKCE();
 
 	// Start local server for callback
@@ -348,8 +342,7 @@ export async function loginGeminiCli(
 		// Calculate expiry time (current time + expires_in seconds - 5 min buffer)
 		const expiresAt = Date.now() + tokenData.expires_in * 1000 - 5 * 60 * 1000;
 
-		const credentials: GoogleCloudCredentials = {
-			type: "oauth",
+		const credentials: OAuthCredentials = {
 			refresh: tokenData.refresh_token,
 			access: tokenData.access_token,
 			expires: expiresAt,
@@ -357,8 +350,6 @@ export async function loginGeminiCli(
 			email,
 		};
 
-		saveOAuthCredentials("google-gemini-cli", credentials);
-
 		return credentials;
 	} finally {
 		server.close();