OAuth/API-key classification can mislabel keys and write to the wrong secret

Opus finding

OAuth/API-key classification can mislabel keys and write to the wrong secret

• dashboard/app/api/auth/route.ts:60-71

Any non-empty body.key that does not start with `sk-ant-oat` (including typos, blanks-with-stray-chars, random strings, or future Anthropic key prefixes) is assumed to be an API key and silently written to ANTHROPIC_API_KEY. There is no validation that the value matches `sk-ant-api...` or any sane format/length. Users can easily blow away a working ANTHROPIC_API_KEY with garbage, and the response cheerfully says `{ ok: true, method: 'api-key' }`.