feat(#493): api-key backend support (useApiKey + backendEnvironmentFile)

hive-agent/src/login.rs

@@ -103,7 +103,13 @@ pub enum LoginState {
 impl LoginState {
     #[must_use]
     pub fn from_dir(dir: &Path) -> Self {
-        if has_session(dir) {
+        // API-key backends (OpenRouter etc.) never populate `~/.claude/` —
+        // there is no OAuth flow to complete, `claude` reads
+        // `ANTHROPIC_BASE_URL`/`ANTHROPIC_API_KEY` from the environment
+        // instead. Checked first: an api-key agent with a stale or absent
+        // credentials dir must report `Online`, not park the turn loop
+        // waiting for a login that will never happen.
+        if using_api_key() || has_session(dir) {
             Self::Online
         } else {
             Self::NeedsLogin
@@ -111,6 +117,16 @@ impl LoginState {
     }
 }
 
+/// Whether this agent is configured to authenticate to its backend with an
+/// API key rather than a Claude OAuth session — set by
+/// `hyperhive.useApiKey` via the `HIVE_USE_API_KEY` env var
+/// (`nix/agent-modules/agent-service.nix`). Read fresh on every call rather
+/// than cached: it's an env var, not a value worth a `OnceLock` for.
+#[must_use]
+pub fn using_api_key() -> bool {
+    std::env::var("HIVE_USE_API_KEY").is_ok_and(|v| v == "1")
+}
+
 /// Baseline for [`has_fresh_credentials`] when the caller has no specific
 /// prior-failure instant to compare against (the cold-boot call site, where
 /// `has_session` already established no credential file exists yet — so