fix(ai): delete auth profile when removing a model service config

When deleteConfig was called, the auth profile written to
auth-profiles.json during addConfig was never cleaned up, leaving
orphaned credentials on disk indefinitely.

Add onApiKeyDeleted callback to LLMConfigStoreDeps and call it in
deleteConfig with the removed config so callers can clean up the
corresponding auth profile. Wire up deleteAuthProfile in both the
CLI HTTP server and the Desktop internal API.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

apps/cli/src/http/index.ts

@@ -32,7 +32,7 @@ import { getAssistantManager, getSkillManagerCore } from '../ai/manager-factory'
 import { createCliRunAgentStream } from '../ai/agent-stream-runner'
 import { initSync, cleanupSync } from '../sync'
 import { resolveCliPath } from '../paths'
-import { resolveApiKey, writeAuthProfile } from '@openchatlab/config'
+import { resolveApiKey, writeAuthProfile, deleteAuthProfile } from '@openchatlab/config'
 import { assertCliDataDirCompatible } from '../runtime-compat'
 
 let server: FastifyInstance | null = null
@@ -164,6 +164,10 @@ export async function startHttpServer(options?: HttpServerOptions): Promise<{
       writeAuthProfile(profileName, { type: 'api_key', provider: config.provider, key: apiKey })
       return profileName
     },
+    onApiKeyDeleted: (config) => {
+      const profileName = (config as unknown as Record<string, unknown>).authProfile as string | undefined
+      if (profileName) deleteAuthProfile(profileName)
+    },
   })
 
   initServerAiLogger(pathProvider.getLogsDir())