#3523 auth login leaves auth.json apiKey empty and stores the key only in ~/.config/swamp/api-key, which the auth gate never reads

Summary

After a successful swamp auth login, every command fails the auth gate with auth_gate_blocked / reason.kind: no_credential, and swamp auth whoami reports "Not authenticated". The credential exists on disk, but the CLI doesn't read it from where login wrote it.

Version

swamp 20261015.204852.0-sha.513280e9, Linux (Debian, kernel 6.12)

What's on disk after login

~/.config/swamp/:

• auth.json: serverUrl, username, collectives and apiKeyFingerprint are populated, but apiKey: "" and apiKeyId: ""
• api-key: the actual API key (written after auth.json; mode 600)
• auth_verified.json, servers.json (the server-login token for a remote serve is present and valid)

Reproduce

1. swamp auth login (completes successfully)
2. swamp auth whoami --json → {"error": "Not authenticated. Run 'swamp auth login' to sign in."}
3. Any gated command, local or --server <remote serve> → auth_gate_blocked, no_credential

Evidence that it's the read path, not the credential

• SWAMP_API_KEY="[REDACTED-SECRET-1]" swamp auth whoami → authenticates as the right user and collectives.
• Copying the contents of api-key into auth.json's apiKey field fixes every command, including remote-serve requests, with no env var.

Expected

Either login writes the key into auth.json as before, or the credential loader / auth gate also reads ~/.config/swamp/api-key. Login and the loader need to agree on where the key lives. whoami should also say "credential file present but key missing" rather than a bare "Not authenticated".

Impact

A freshly signed-in user, including one connecting to a remote swamp serve with a valid server-login token, gets blocked on every command right after a successful login. The error tells them to run swamp auth login, which they just did.