fix(auth): honor OPENCODE_SERVER_USERNAME env var for basic auth (#1705)

Fix #1685: the Basic auth header for the OpenCode server was hardcoded
to use the username 'opencode', ignoring OPENCODE_SERVER_USERNAME. Users
who set a custom username got 401 errors because the server expected a
different credential.

Both call sites (web server auth-state-runtime.js and VS Code
extension opencode.ts) now read process.env.OPENCODE_SERVER_USERNAME
with a fallback to 'opencode' to preserve prior behavior.

Co-authored-by: Leonid Skorobogatyy <bash@opencode.itc.local>

packages/vscode/src/opencode.ts

@@ -73,7 +73,8 @@ function generateSecureOpenCodePassword(): string {
 }
 
 function buildOpenCodeAuthHeader(password: string): string {
-  return `Basic ${Buffer.from(`opencode:${password}`, 'utf8').toString('base64')}`;
+  const username = process.env.OPENCODE_SERVER_USERNAME || 'opencode';
+  return `Basic ${Buffer.from(`${username}:${password}`, 'utf8').toString('base64')}`;
 }
 
 function isValidOpenCodePassword(password: string): boolean {

packages/web/server/lib/opencode/auth-state-runtime.js

@@ -51,7 +51,8 @@ export const createOpenCodeAuthStateRuntime = (dependencies) => {
       return {};
     }
 
-    const credentials = Buffer.from(`opencode:${password}`).toString('base64');
+    const username = process.env.OPENCODE_SERVER_USERNAME || 'opencode';
+    const credentials = Buffer.from(`${username}:${password}`).toString('base64');
     return { Authorization: `Basic ${credentials}` };
   };