fix(auth): harden logout proxy traps from review feedback

- get() now returns undefined for logged-out providers instead of
  delegating to target.get() which could bypass the guard
- getCredential() in provider-auth returns undefined for logged-out
  providers instead of falling through to authStorage.get()
- getAll() skips logged-out providers at top of loop
- list() filters modelsJsonApiKeys against loggedOutProviders
- Added remove() trap in provider-auth for clearApiKey flow

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

packages/cli/src/commands/provider-auth.ts

@@ -157,7 +157,7 @@ export function mergeAuthStorageReads(
 
   const getCredential = (providerId: string) => {
     if (loggedOutProviders.has(providerId)) {
-      return authStorage.get(providerId) as StoredCredential | undefined;
+      return undefined;
     }
     return selectCredential(providerId, readAuthStorages);
   };
@@ -190,6 +190,13 @@ export function mergeAuthStorageReads(
         };
       }
 
+      if (prop === "remove") {
+        return (provider: string) => {
+          loggedOutProviders.add(provider);
+          target.remove(provider);
+        };
+      }
+
       if (prop === "set") {
         return (provider: string, credential: AuthCredential) => {
           loggedOutProviders.delete(provider);