feat: wave 3 — reconfigure safety (merge writes, password, test-before-apply, drain)

[wra-sol]

Summary

Wave 3 of the opencode manager improvement plan. Four slices, one PR.

3.1 — Merge-based .setup.env writes (closes #9)

/setup now loads the existing .setup.env and merges form fields into it, preserving any env vars not managed by the form (e.g. keys rotated via /manage/keys/rotate, or custom env vars added out-of-band). Uses the same Settings.write path as /manage/keys/rotate for consistency. MCP keys for unchecked MCPs are dropped; re-checked MCPs with blank key fields preserve existing keys.

3.2 — No surprise password regen (closes #10)

Blank password on reconfigure = keep current (not auto-generate). A separate change_password field is shown on the reconfigure form for explicit password changes. First-run still auto-generates if blank (unchanged bootstrap behavior). The success page only shows the password when it was (re)generated or explicitly changed.

3.3 — Server-side test-before-apply on provider key (closes #11)

On reconfigure: if the provider key differs from the current one (or the provider changed), validate_provider_key runs before writing .setup.env or restarting the child. On failure: the form is re-rendered with an error, no restart, no .setup.env write. First-run is exempt (the standalone Test button is the validation path there).

3.4 — Graceful drain on restart + 503 Retry-After (closes #12)

ChildProcess.draining flag is set during restart. The proxy returns 503 + Retry-After: 10 when the child is draining or down (replaces the old bare 503 with no retry hint). The restart method accepts a reason parameter (manual, reconfigure, etc.) for better telemetry.

Tests

7 new test cases:

• Reconfigure preserves unmanaged keys, MCP key preservation when rechecked
• Blank password keeps current, explicit password change updates
• First-run blank password auto-generates
• 503 Retry-After on proxy during downtime

114 total tests pass. Lint + format clean.