fix: validate saved tokens + handle FlyV1 auth scheme

[AhmedTMM]

Summary

• Validate saved API tokens before use: Tokens loaded from config files (e.g. ~/.config/spawn/fly.json) were never validated, so expired/revoked tokens silently passed through and only failed at the point of use. Now the provider's test function runs on config-file tokens, falling through to a fresh prompt on failure.
• Handle FlyV1 token format for Fly.io: Dashboard tokens use the format FlyV1 fm2_... where FlyV1 is the authorization scheme itself. The script was sending Authorization: Bearer FlyV1 fm2_... which the API rejects. Now detects FlyV1-prefixed tokens and sends Authorization: FlyV1 fm2_... directly.

Test plan

• Run bash test/run.sh — all tests pass
• Test with an expired token in ~/.config/spawn/fly.json — should warn and prompt for new one
• Test with a FlyV1 fm2_... token from Fly.io dashboard — should authenticate successfully
• Test with a legacy Bearer token from flyctl auth token — should still work

🤖 Generated with Claude Code

[louisgv]

Security Review

Verdict: APPROVED

Findings

None. All changes are security-positive.

Security Analysis

1. Token Validation Enhancement (shared/common.sh:2570-2577)

POSITIVE: Adds validation for saved tokens before use.

• Calls optional test_func to verify token is still valid
• Falls through to re-prompt on validation failure
• Properly unsets invalid token before re-prompting
• Uses 2>/dev/null to suppress stderr from test function (safe)
• No command injection risk - test_func is passed as function name, not eval'd string

2. FlyV1 Auth Scheme Support (fly/lib/common.sh:37-41)

POSITIVE: Adds support for new Fly.io token format without security regressions.

• Properly handles FlyV1 fm2_... token format via custom auth
• Token is passed through -H "Authorization: $FLY_API_TOKEN" which is safe (quoted variable expansion)
• Falls back to Bearer token for legacy tokens
• No command injection risk - token is properly quoted in all paths
• Uses existing generic_cloud_api_custom_auth which has been audited

3. Refactor Service Improvements (.claude/skills/setup-agent-team/refactor.sh:410-441)

NEUTRAL: Documentation/prompt improvements only.

• No code changes, only inline documentation updates
• Clarifies team coordination protocol
• Improves shutdown sequence documentation

Tests

• bash -n: PASS (all 3 files)
• bun test: PASS (7809 pass, 235 pre-existing failures unrelated to this PR)
• curl|bash: OK (source fallback pattern preserved in fly/lib/common.sh)
• macOS compat: OK (no bash 3.x incompatible syntax introduced)

Security Properties Maintained

✅ No new command injection vectors
✅ No credential leaks
✅ No path traversal issues
✅ No unsafe eval/source patterns
✅ curl|bash compatibility preserved
✅ Proper variable quoting throughout
✅ Token validation improves security posture

---

-- security/pr-reviewer-1386