test(setup): cover key validation, env loading and persistence (closes #59)

[dchaudhari7177]

Closes #59.

21 cases in tests/test_setup.py, covering the matrix from the issue. Nothing reaches the network — requests.get is mocked throughout, following the pattern in tests/test_models.py.

validate_api_key

200, 401, 403, ConnectionError / Timeout / SSLError (parametrised), and an unhandled 500 arriving via raise_for_status.

Two of these are doing more than restating the branch:

• test_401_and_403_do_not_share_a_message — distinguishing them is the point of handling them separately, and a refactor that collapsed both into one string would pass every other test here.
• test_validate_sends_the_key_as_a_bearer_token — a mocked 200 proves nothing about what was sent, so this checks the key reaches the Authorization header (and that the 15s timeout is still passed).

get_api_key

Empty when unset, reads OPENROUTER_API_KEY, falls back to OPENAI_API_KEY, OpenRouter wins when both are set, and a blank OPENROUTER_API_KEY falls through rather than being returned — that last one is a real property of the or chain that would be easy to break by switching to os.environ.get(..., default).

load_env / save_api_key

File present and absent (first run must not raise), override=True beating a stale variable, directory creation, preserving whichever variable was already set, and a save-then-load round trip standing in for a restart.

Two safety notes

• An autouse fixture clears both key variables before each test, so a key in the developer's environment can't decide the outcome of a precedence test.
• An env_file fixture redirects _ENV_DIR / _ENV_FILE at tmp_path. Without it, save_api_key writes to the real ~/.gcode/.env — running the suite would overwrite the developer's own key. Worth knowing before adding more tests here.

Verification

pytest tests/test_setup.py — 21 passed. ruff check clean. Test-only; no production change.

Full suite on this branch: 73 passed, 2 failed — the 2 are test_tools.py::test_grep / ::test_grep_ignore_case, failing on a Windows checkout of main for an unrelated reason, sent as #78.