[FEATURE]: Store provider credentials in environment variables #5423

Feature hasn't been suggested before.

• I have verified this feature I'm about to request hasn't been suggested before.

Describe the enhancement you want to request

User problem

As a security minded user, I don't want to store api keys in files, especially not in a shared environment.

Instead of storing provider credentials in ~/.local/share/opencode/auth.json, I'd prefer to either have the location configurable (e.g. setting $OPENCODE_AUTH_JSON would tell opencode where it should read/write the auth.json file) or allow passing provider keys through environment variables.

Proposal

I see two different approaches

Configurable auth.json location (recommended)

Currently, the location of the opencode auth.json is hardcoded. We should make this configurable with the OPENCODE_AUTH_JSON environment variable. The default value can be ~/.local/share/opencode/auth.json to keep it backward compatible.

Passing provider keys from environment variables

I see three possible approaches:

1. for every configured provider with an invalid/not configured apiKey, opencode looks for the OPENCODE_<PROVIDERNAME>_APIKEY environment variable
2. for every known provider, opencode looks for the OPENCODE_<PROVIDERNAME>_APIKEY environment variable
3. for every configured provider with type: "api", keyFrom: "envVar" opencode looks for the OPENCODE_<PROVIDERNAME>_APIKEY environment variable

Related issues

• feature: Ability to pass credentials without storing in environment file #318 is the closes related, but it misses the configurable auth.json proposal that could work well in many situations