fix(auth): document MMX_CONFIG_DIR in credential errors

[kartikkabadi]

Summary

Documents the existing MMX_CONFIG_DIR environment variable and includes it in the remediation guidance shown when the CLI cannot find credentials.

This helps users running mmx from agents, services, CI jobs, or subprocesses whose resolved home directory differs from the credential owner's — the exact scenario in #185, where os.homedir() returns a different path than where ~/.mmx/config.json lives.

Before

No credentials found.
hint: Log in:        mmx auth login
      Pass directly:  --api-key sk-xxxxx

The hint mentioned only two remediation options. MMX_CONFIG_DIR was functional but undocumented — users only discovered it by reading src/config/paths.ts.

After

No credentials found.
hint: Looked for credentials in: /resolved/path/.mmx/config.json
      Log in:          mmx auth login
      Pass per-call:   --api-key sk-xxxxx
      Or set env var:  MMX_CONFIG_DIR=/path/to/.mmx

Why MMX_CONFIG_DIR and not MINIMAX_API_KEY

MMX_CONFIG_DIR is a working remediation: it changes where the CLI looks for config.json, so credentials saved via mmx auth login are found even when os.homedir() differs.

MINIMAX_API_KEY is not listed in the hint because it does not work end-to-end. ensureAuth() in src/auth/setup.ts recognizes it and returns early, but the actual request path calls resolveCredential() in src/auth/resolver.ts, which never reads process.env.MINIMAX_API_KEY — it only checks config.apiKey (the --api-key flag), OAuth credentials, and config.fileApiKey. So a user setting MINIMAX_API_KEY would pass the setup gate but still get "No credentials found" when the first real request is made. Listing it as a remediation would be misleading.

This PR does not fix MINIMAX_API_KEY — that is a separate pre-existing issue tracked in #192 and outside the scope of #185. It only lists remediation options that genuinely work.

Changes

• src/auth/hints.ts — centralize the shared no-credentials remediation and include the exact config.json path that was searched.
• src/auth/resolver.ts — use the shared hint for request-time credential resolution.
• src/auth/setup.ts — use the same hint on the non-interactive setup path.
• README.md — add an "Environment variables" section documenting the supported env vars, including MMX_CONFIG_DIR with guidance for subprocess/CI usage.
• ERRORS.md — add the previously-missing "No credentials found" row to the auth error reference.
• test/auth/resolver.test.ts — cover both error paths, assert the resolved config path, and isolate/restore MMX_CONFIG_DIR and MINIMAX_API_KEY so local developer environments cannot affect the tests.

Scope

This does not change credential lookup behavior or attempt automatic cross-user credential discovery. It only makes the existing MMX_CONFIG_DIR override discoverable — the minimal Option A from the issue.

Testing

• bun test test/auth/resolver.test.ts — 6/6 pass (2 new)
• bun run typecheck — pass
• bun run lint — no new errors (2 pre-existing errors in unrelated test files on upstream/main)
• bun test — no new failures (40 pre-existing failures on upstream/main are unrelated to auth; +2 tests, +2 pass)
• bun run build — pass

Reproduction

# From a subprocess whose HOME differs from where you ran `mmx auth login`:
HOME=/tmp/nonexistent mmx quota show --output json
# Before: hint only mentions mmx auth login / --api-key
# After: hint also mentions MMX_CONFIG_DIR

Fixes #185