fix(console): route new Console keys to inference

[vaprdev]

Problem

The V2 Console issues service-account API keys with the oc_sk_ prefix. The documented Go flow (create key in Console → /connect → OpenCode Go → paste) sends them to https://opencode.ai/zen/go/v1, where proxyInference decides whether to forward to the new inference application by looking the key up in the legacy key table and checking workspace.migrated_at.

New keys have never existed in that table, so the lookup returns nothing, the request falls through to the legacy Zen handler, and the user gets Invalid API key. in the TUI.

Change

inference-proxy.ts: keys starting with oc_sk_ skip the legacy lookup and are forwarded to the mapped /inference/... path unconditionally. The destination owns authentication, revocation, and accounting as before.

Old sk- keys are unchanged: migrated workspaces forward, unmigrated workspaces stay on legacy Zen.

Supporting cleanup in the same file:

• The lookup moved into a migratedWorkspace helper that filters migrated_at IS NOT NULL in SQL, so the caller only asks "is there a routable workspace?" (if (legacy && !workspace) return undefined).
• Dropped the !go && condition on the ProviderTable join. Every /zen/go/* route uses modelList: "lite", so handler.ts already passes provider: undefined for Go; the proxy was re-checking what the caller owns.

Why the prefix is a safe discriminator

• Both legacy key generators (console/core/src/key.ts, console/core/script/create-api-key.ts) produce sk- + 64 alphanumerics and always have.
• Verified against production opencode.key: 3,729,853 rows, all matching ^sk-[A-Za-z0-9]{64}$.
• New service_api_key prefixes are only oc_sk_... (native) and sk-... (imported legacy).

No format validation beyond the prefix: a forged oc_sk_ gains nothing but a 401 from the destination.

Verification

• bun typecheck in packages/console/app; pre-commit turbo typecheck across the repo.
• No existing tests cover this module; it is DB-backed and forwards via fetch, so a unit test would need to mock both. Not added.
• Not exercised against a deployed stage. Preview stages have an empty ConsoleMigration.inferenceUrl, so forwarded requests there return 503; oc_sk_ keys on preview move from legacy's 401 to that 503, same as migrated keys already do.

Companion

anomalyco/opencode-console#2280 updates the inference README "Public Routing Gate" section to reference this change.

[github-actions]

This PR doesn't fully meet our contributing guidelines and PR template.

What needs to be fixed:

• PR description is missing required template sections. Please use the PR template.

Please edit this PR description to address the above within 2 hours, or it will be automatically closed.

If you believe this was flagged incorrectly, please let a maintainer know.

[github-actions]

Thanks for your contribution!

This PR doesn't have a linked issue. All PRs must reference an existing issue.

Please:

1. Open an issue describing the bug/feature (if one doesn't exist)
2. Add Fixes #<number> or Closes #<number> to this PR description

See CONTRIBUTING.md for details.