v0.21.1 — Claude Code identity injection for OAuth tokens

Ships the opt-in Claude Code identity injection for OAuth subscription tokens, resolving the premium-model gating reported in #74.

Added

• Opt-in Claude Code identity injection for OAuth tokens (NADIRCLAW_CLAUDE_CODE_IDENTITY=1, default off) (#74, #75) — Anthropic gates premium models (Sonnet/Opus) behind subscription/OAuth tokens (sk-ant-oat*) unless the request leads with the official Claude Code identity system block. The real client always sends it; raw API/SDK callers omit it and get a bare rate_limit_error on those models while Haiku works. When enabled, /v1/messages and the OAuth completion path prepend "You are Claude Code, Anthropic's official CLI for Claude." as the first system block — only for Bearer/OAuth tokens (no effect on sk-ant-api* keys), only when not already present, preserving any caller-supplied system prompt after it. The decision is recorded as claude_code_identity on the request log.

Fixed

• OAuth completion path sent system turns as chat messages (#74) — the direct Anthropic OAuth call in /v1/chat/completions forwarded role: "system" messages inside the messages array, which Anthropic's /v1/messages API rejects (system must be a top-level field). System/developer turns are now collected into the top-level system field before forwarding.

Reported and verified by @ThunderEagle: Haiku/Sonnet/Opus all return completions on the same sk-ant-oat* token with the flag enabled. See the README "subscription token / premium models" troubleshooting section for usage.