fix: affitor status and test run with an API key and no project config (QA-33)

[sonpiaz]

What

affitor status and affitor test read the project config through a new readConfigOrKeyOnly(flags): when the directory has no .affitor/config.json but a key was passed with --api-key or AFFITOR_API_KEY, they run without it. The API already resolves the program from the key (authenticateRequest → findProgramByApiToken); program_id in the query/body was never used. status prints the domain the API returns instead of config.domain. With neither config nor key, the error now says "Run npx affitor init to set up a new program, or set AFFITOR_API_KEY to use an existing one."

Why (QA-33)

Measured 13/10 with the test program's key on prod:

• affitor@0.4.2 status in a directory without config → ✗ No Affitor config found … Run npx affitor init. init needs affitor login and creates a new program, so a brand whose program was made in the dashboard had no way to use status/test.
• With a hand-written {version, program_id} config, status worked but printed undefined for the domain and t.undefined in the DNS hint.
• This branch, built locally, in an empty directory with only AFFITOR_API_KEY: status 200 for program 1189, domain example.com (.internal/qa/2026-10-12/raw/qa33-cli-key-only-prod.txt).

Separate, not in this PR: affitor login offers only "Sign in with Google", so a brand that signed up with email + password cannot log in to the CLI (auth decision, reported to the manager).

Test

tests/status-test-key-only.test.ts (3 cases, committed first, 3 red on main): status with AFFITOR_API_KEY and no config calls /api/v1/cli/status with that key and prints the API domain, no "undefined"; test with --api-key and no config posts the event; with neither, the message names AFFITOR_API_KEY.

• vitest run: 14 files, 118 tests pass. tsc --noEmit 0 errors. npm run build ok.

🤖 Generated with Claude Code