Route the application-passwords list screen through Basic auth

[jkmassel]

Fixes a bug where the application-passwords list screen returned an empty list / auth error on Atomic sites.

Summary

• Swap wpApiClientProvider.getWpApiClient(site) → wpApiClientProvider.getApplicationPasswordClient(site) in ApplicationPasswordsViewModel.kt.
• Self-hosted behavior unchanged (both providers return the same Basic-auth client for those sites).
• Atomic / Jetpack-WPCom-REST: now talks directly to the site's host instead of the WP.com REST proxy.

Root Cause

getWpApiClient routes WPCom-flagged sites (including Atomic) through the WP.com REST proxy at https://public-api.wordpress.com/rest/v1.1/sites/{id}/wp/v2/.... The proxy doesn't expose the application-passwords routes — every request 404s with rest_no_route. The same upstream wordpress-rs limitation (Automattic/wordpress-rs#1350) drove dropping the headless wordpress-rs mint attempt in #22885.

Fix

getApplicationPasswordClient(site) always builds a direct-host Basic-auth client using the SiteModel's apiRestUsernamePlain / apiRestPasswordPlain. The direct host serves the application-passwords routes on every WordPress install.

Limitations

The SiteModel must already have credentials — typically populated by the My Site auto-mint flow on first foreground (introduced in #22885). A user reaching the list screen without ever visiting My Site would 401 instead of seeing the (already-empty) screen. Out of scope here; can be handled by minting on demand if it turns out to matter.

Test plan

• Open an Atomic site → Me → Application Passwords. List displays correctly.
• Open a self-hosted site with stored creds → Me → Application Passwords. List displays correctly (regression check).
• Delete an app password server-side → re-open the screen. Error message surfaces correctly.

Related

• Stacked on Allow headless application-password creation on Atomic sites #22885 (the Atomic headless mint feature, which provides getApplicationPasswordClient).
• WpApiClient.applicationPasswords().createForCurrentUser fails with rest_no_route on Atomic (WP.com proxy) Automattic/wordpress-rs#1350 — the upstream limitation this works around.

[dangermattic]

	1 Message
📖	This PR is still a Draft: some checks will be skipped.

Generated by 🚫 Danger