feat!: remove API key authentication

[mellelieuwes]

Flux issue: 10390265686, "flux CLI: remove the --api-key flag (server rejects API keys since #38)".

Since server release #38 ("Flux is middleware") the server rejects shared API keys. The CLI still offered --api-key and FLUX_API_KEY.

Changes

• --api-key stays registered but hidden. Using it stops with API keys are no longer supported; run flux auth login (exit 1, no usage dump), so old scripts fail with a helpful message instead of unknown flag. The check sits in the root PersistentPreRunE (there were no other pre-run hooks), so it covers every command.
• FLUX_API_KEY is ignored. When it's set, a warning goes to stderr and the command continues with the saved flux auth login credentials.
• getAPIKey() is renamed to getAccessToken(), and the api.Client field apiKey to token. Both now only carry the saved OAuth access token. Mechanical rename across cmd/.
• README and skill/SKILL.md no longer mention API keys, --api-key or FLUX_API_KEY; they only say to sign in with flux auth login. The README's local-server example now signs in instead of passing --api-key.
• No workflow or release step uses FLUX_API_KEY or --api-key (checked .github/workflows and .goreleaser.yml).

Tests

• New table-driven TestRemovedAPIKey: no key, the flag after the command, the flag before the command, the flag on auth status, and the env var (warning only). Plus TestAPIKeyFlagHidden.
• TestAuthStatusVerifiedIdentity now checks that a set FLUX_API_KEY is ignored and the personal token is sent.
• The content-command tests sign in with a saved fixture token instead of --api-key.
• go test -race ./..., go vet ./... and go mod tidy -diff all pass. A mutation check (disabling the flag check) makes TestRemovedAPIKey fail.
• Manual check with a built binary: flux projects list --api-key x and flux --api-key=x issues list exit 1 with the message, --help no longer lists the flag, and FLUX_API_KEY=x flux projects list warns and continues.

This is a breaking change (feat!). It ships with the next CLI release.

🤖 Generated with Claude Code

_{Written by an AI agent (Claude Code · claude-opus-5-5, herdr-projects flux · t-0048).}