Setup asks for the Resend key and writes the Credentials #192

Parent

#190

What to build

With Run notifications on, Setup asks for the Resend API key with input hidden and saves it in the Credentials (~/.thirdshift/credentials.toml, mode 0600). The user no longer has to work out which shell profile to edit. This applies both to thirdshift setup and to the first Run's Setup offer answered Yes. It uses the key lookup from #191 to know whether a key is already saved or comes from RESEND_API_KEY, and to refuse a broken Credentials file.

Acceptance criteria

• From a terminal, with notifications on, after the sender question:
  • with no key anywhere, Setup prompts Resend API key (input hidden, Enter to skip):;
  • with a key only in the Credentials, it prompts Resend API key (input hidden, Enter keeps the saved one):;
  • with RESEND_API_KEY set and non-empty, it doesn't prompt and prints a line saying the key comes from RESEND_API_KEY.
• Input is read with echo off and trimmed. Non-empty input not starting with re_ is rejected and asked again.
• Skipping writes no Credentials and prints how to add a key later (rerun thirdshift setup, or set RESEND_API_KEY). The old export RESEND_API_KEY=... shell-profile hint is gone.
• Entering a key creates the Credentials at mode 0600, and ~/.thirdshift if needed. Over an existing file, it edits in place: comments and other content kept, only resend.key changed, and no commented-out defaults added.
• When it writes the Credentials, Setup prints wrote the Credentials <path> on stderr. The key never appears on stdout or stderr, not even partly masked.
• A Credentials file that fails the strict parse is refused before any questions, exit 1, and left untouched.
• Ctrl-C at any question, the key prompt included, writes neither the User config nor the Credentials.
• With notifications off, nothing about a key is asked, and an existing Credentials file is left as it was.
• The first Run's Setup offer, answered Yes, asks the same key question. Answered No, or with no terminal, nothing is asked about a key and no Credentials are written.
• The test-email offer (default No) sends with the key the lookup now finds, including one just entered.
• The README's User config section (Setup step 4) describes the key prompt and the Credentials.
• Tests go through the binary on a pseudo-terminal (run_on_terminal) in tests/setup.rs and tests/setup_offer.rs. The existing key-hint tests are updated to the new behaviour, not deleted.

Blocked by

• Runs and email-test find the Resend key in the Credentials #191