v0.1.18 — credential import confirms, closes, and reloads

Fixes the credential-import experience reported from the settings page: pasting an
API key gave no sign it had been checked, left the dialog open, and left the usage
card showing the previous account.

Cause

One dependency. Both the dialog close and the usage re-read hung off
status.authenticated, which does not change when a Kiro IDE credential is already
present — precisely the situation a first import happens in. Signing in from a
signed-out page worked, so the bug only showed on the path most users take.

The effects now key on which credential is in force (source, method, expiry), and
the import closes and refreshes directly rather than waiting on a derived change,
because re-importing the same kind of credential can leave every observed field
equal.

The confirmation says what was verified

• API key — already validated against the live model catalog before storage;
  that check's model count now reaches the page: Credential verified · 19 models available
• Refresh token — reports verification, because its exchange minted a real
  access token
• External IdP JSON — only reshaped locally, so it says Credentials saved and
  claims nothing more

The notice clears itself after eight seconds and cancels its timer on unmount.

Also

The pasted secret is dropped from the page once the server holds it — keeping a
copy in component state only widens where it can leak.

Verification

Against the live deployment: a bogus key returns Kiro API key validation failed,
and replaying the stored key returns verified: {"models": 19} with the usage card
repopulating (KIRO PRO MAX, credits 237.09/5000). Six of the eight new tests in
tests/client-import.spec.ts fail against the previous revision. npm run check:
193 tests pass, 9 live probes skipped.

Install

dsh plugin --profile <name> add github:dat-lequoc/dsh-kiro#v0.1.18

Artifact checksum

sha256  f59d02cb381c827d810a3cda7fc7c3c29b19dbac96f46b2fee6a7423bf5cfdd2  dsh-kiro-0.1.18.tgz