Move API credential resolution out of api/client.rs into api/client/credentials.rs #913

[agent] Filed by the scheduled architecture audit routine (CLI and core). Register: register comment.

Kind: refactor (a mechanical move). Source: review Part 7.2 and 7.6 #8, register row C29. This is the second of two moves; the first is #871 (the vendoring-service client).

Problem (main @ 9c43dfc)

api/client.rs is 6,030 lines. Besides the patch API client, it holds the whole credential and environment layer, which doesn't depend on any client internals except ApiClient::new and resolve_org_slug:

• ApiClientEnvOverrides, get_api_client_from_env, resolve_ambient_credentials, resolve_credentials_with_origin, get_api_client_with_overrides, build_proxy_fallback_client, looks_like_token_hash, validate_token_shape, TokenSource and is_fallback_candidate: L2039–L2368, about 330 lines.
• The three once-only notice flags that only this layer uses (PROXY_NOTICE_SHOWN, TOKEN_SHAPE_SHOWN, ORG_DETECT_SHOWN): L30–L32.
• Its 16 unit tests sit in the general mod tests, mixed with JSON-client tests: no_api_token_veto_forces_public_proxy (L3024), the three resolve_ambient_credentials_* tests (L3043–L3072), explicit_token_override_survives_veto (L3092), test_get_api_client_from_env_no_token (L3192), empty_org_slug_override_does_not_become_empty_slug (L3201), org_auto_resolution_401_with_hash_shaped_token_hint_arm (L3378), the seven validate_token_shape_* tests (L3704–L3837) and looks_like_token_hash_recognizes_sri_prefixes (L4004).

Credential precedence (flag → env → socket-cli config, SOCKET_NO_API_TOKEN, the empty-means-unset rule) is the part of the client that the open work on C07 (#648), C09/C39 (#647) and C19 (#727) needs to read and change. Today it is scattered between the JSON request loop and the batch helpers.

Symptoms

None filed. Impact: maintainability and reviewability. #647 (moving the proxy fallback into ApiClient) and decision #648 (where calls go when org resolution fails) both edit this region.

Proposed change

• Create api/client/credentials.rs as a child module of client (the same layout as Move the vendoring-service client out of api/client.rs into its own submodule #871: client.rs → client/mod.rs, or #[path]), so it can call ApiClient::new and resolve_org_slug with no visibility changes.
• Move the items listed above, together with the three notice statics.
• Move the 16 tests listed above into api/client/credentials_tests.rs (#[cfg(test)] #[path] mod). Bodies stay unchanged.
• Re-export the public names from client (pub use credentials::{…}), so socket_patch_core::api::client::get_api_client_with_overrides and the other 9 CLI import sites, telemetry.rs, blob_fetcher.rs and the core integration tests don't change.
• Deleted from client.rs: the ~330-line credential block, the three statics and the 16 tests.

There are no behavior changes, renames or signature changes.

Size and scope

• About 330 production lines and about 500 test lines move. The net diff should be about 0 apart from mod/use lines.
• Out of scope: any change to precedence or fallback behavior (Only scan, get <uuid> and vex fall back to the public proxy on 401/403; get search, apply, rollback, repair and vendor eject fail #647, Decide: where patch API calls go when a token is set but the org slug can't be resolved #648, Read env toggles, non-empty env vars and the home directory through one utils::env module #727); classify_auth_error, throttled_error and select_org_slug, which classify client responses and stay with the JSON client; the vendoring-service move (Move the vendoring-service client out of api/client.rs into its own submodule #871).

Acceptance criteria

• grep -c "fn resolve_credentials_with_origin\|fn validate_token_shape\|fn build_proxy_fallback_client\|struct ApiClientEnvOverrides" on client.rs/client/mod.rs prints 0.
• No use line outside crates/socket-patch-core/src/api/ changes.
• git diff -M --stat shows the moved tests as moves, and no test bodies changed.
• cargo test -p socket-patch-core --lib api:: passes with the same test count before and after, as do binary_fetch_error_classification_e2e and the CLI's cli_config_fallback and cli_global_args.
• cargo clippy --workspace --all-features -- -D warnings is clean.

Dependencies

• Independent of Move the vendoring-service client out of api/client.rs into its own submodule #871; whichever lands second adds its own submodule beside the other. If Move the vendoring-service client out of api/client.rs into its own submodule #871 lands first it creates client/mod.rs, and this goes next to it.
• Land before Only scan, get <uuid> and vex fall back to the public proxy on 401/403; get search, apply, rollback, repair and vendor eject fail #647 if possible, so Only scan, get <uuid> and vex fall back to the public proxy on 401/403; get search, apply, rollback, repair and vendor eject fail #647 edits credentials.rs rather than moving with it. No open PR edits L2039–L2368 today.