refactor(auth): unify OAuth credentials into config.json

[kapelame]

Summary

Builds on #134 and addresses two pieces of feedback from review:

1. No separate credentials.json file. OAuth tokens now live inside the existing ~/.mmx/config.json under an oauth subobject. Single source of truth for all CLI state, simpler logout, one file to back up / migrate.

2. Config.oauthApiHost is optional, derived lazily. A new oauthApiHostFor(config) helper falls back to OAUTH_API_HOSTS[config.region] when the field is unset. This removes the cascade of test-fixture churn that adding it as a required field caused — every command-test mock would have needed an oauthApiHost: '...' line just to typecheck.

Also fixes one pre-existing failing test (test/auth/timeout-fix.test.ts) where the mock response shape and URL pattern weren't updated when the OAuth endpoint changed in #134.

Diff

src/auth/credentials.ts         | load/save/clear now read/write the oauth subobject
src/auth/resolver.ts            | use oauthApiHostFor(); source label "config.json"
src/auth/setup.ts               | use oauthApiHostFor()
src/commands/auth/login.ts      | "Credentials saved to ~/.mmx/config.json"
src/commands/auth/logout.ts     | clear oauth from config.json instead of unlinking the file
src/commands/auth/refresh.ts    | use oauthApiHostFor()
src/config/loader.ts            | drop readCredentialResourceUrl shim, use file.oauth?.resource_url
src/config/paths.ts             | drop getCredentialsPath
src/config/schema.ts            | OAuthCredentials type + oauth field + parser + helper
test/auth/timeout-fix.test.ts   | align refresh mock with new response shape

10 files, +88 / -83.

Resulting ~/.mmx/config.json schema

{
  "api_key": "sk-cp-...",          // optional, as before
  "region": "global",
  "oauth": {                       // new — was a separate credentials.json
    "access_token": "...",
    "refresh_token": "...",
    "expires_at": "2026-05-15T12:34:56Z",
    "token_type": "Bearer",
    "resource_url": "https://api.minimax.io"
  },
  "base_url": "...",
  "output": "text"
}

Test plan

• bun run typecheck clean
• bun test 212 / 212 pass
• bun run lint clean
• bun run build produces dist/mmx.mjs (138 KB)
• mmx auth login (CN region) — interactive OAuth completes, tokens saved to config.json
• mmx auth status — reads oauth subobject correctly (Method: oauth, Source: config.json)
• mmx auth logout — clears oauth from config.json (api_key untouched if present)