When OAuth refresh fails during model discovery, getApiKey() now returns undefined instead of throwing. This allows the app to start and fall back to other providers, so the user can /login to re-authenticate. fixes #498