Move external secrets behind auth broker

app/test/auth/auth_session_store_test.dart

@@ -22,13 +22,6 @@ void main() {
         tenantName: 'Hanmac',
         tenantSlug: 'hanmac',
       ),
-      orgContextCredential: OrgContextCredential(
-        baseUrl: 'https://sadmin.hmac.kr',
-        tenantSlug: 'hanmac-family',
-        keyId: 'session-key-id',
-        keySecret: 'session-key-secret',
-        expiresAt: DateTime.parse('2099-07-02T13:00:00Z'),
-      ),
     );
 
     await store.save(response);
@@ -36,8 +29,6 @@ void main() {
 
     expect(loaded?.token, 'session-token');
     expect(loaded?.user.name, 'User One');
-    expect(loaded?.orgContextCredential?.keyId, 'session-key-id');
-    expect(loaded?.orgContextCredential?.keySecret, 'session-key-secret');
 
     await store.clear();
     expect(await store.load(), isNull);

app/test/organization/org_context_api_client_test.dart

@@ -22,14 +22,12 @@ void main() {
         expect(request.url.queryParameters['tenantSlug'], 'hanmac-family');
         expect(request.url.queryParameters['includeUsers'], 'true');
         expect(request.url.queryParameters['includeUserIds'], 'true');
-        expect(request.headers['X-Baron-Key-ID'], 'key-id');
-        expect(request.headers['X-Baron-Key-Secret'], 'key-secret');
+        expect(request.headers.containsKey('X-Baron-Key-ID'), isFalse);
+        expect(request.headers.containsKey('X-Baron-Key-Secret'), isFalse);
 
         return _jsonResponse(_orgContextResponse());
       }),
       baseUri: Uri.parse('https://sadmin.hmac.kr'),
-      keyId: 'key-id',
-      keySecret: 'key-secret',
       tenantSlug: 'hanmac-family',
     );
 
@@ -49,7 +47,7 @@ void main() {
     expect(is3.totalMemberCount, 2);
   });
 
-  test('uses session org-context credential before env fallback', () async {
+  test('does not persist or send session org-context credentials', () async {
     const store = AuthSessionStore();
     await store.save(
       PhoneLoginResponse(
@@ -64,27 +62,19 @@ void main() {
           tenantName: '',
           tenantSlug: '',
         ),
-        orgContextCredential: const OrgContextCredential(
-          baseUrl: 'https://session.example.test',
-          tenantSlug: 'session-family',
-          keyId: 'session-key-id',
-          keySecret: 'session-key-secret',
-        ),
       ),
     );
 
     final client = OrgContextApiClient(
       httpClient: MockClient((request) async {
-        expect(request.url.host, 'session.example.test');
-        expect(request.url.queryParameters['tenantSlug'], 'session-family');
+        expect(request.url.host, 'env.example.test');
+        expect(request.url.queryParameters['tenantSlug'], 'env-family');
         expect(request.headers['Authorization'], 'Bearer session-token');
-        expect(request.headers['X-Baron-Key-ID'], 'session-key-id');
-        expect(request.headers['X-Baron-Key-Secret'], 'session-key-secret');
+        expect(request.headers.containsKey('X-Baron-Key-ID'), isFalse);
+        expect(request.headers.containsKey('X-Baron-Key-Secret'), isFalse);
         return _jsonResponse(_orgContextResponse());
       }),
       baseUri: Uri.parse('https://env.example.test'),
-      keyId: 'env-key-id',
-      keySecret: 'env-key-secret',
       tenantSlug: 'env-family',
       sessionStore: store,
     );
@@ -99,8 +89,6 @@ void main() {
         return _jsonResponse(_orgContextResponse());
       }),
       baseUri: Uri.parse('https://sadmin.hmac.kr'),
-      keyId: 'key-id',
-      keySecret: 'key-secret',
       tenantSlug: 'hanmac-family',
     );
 
@@ -115,8 +103,6 @@ void main() {
         return _jsonResponse(_orgContextResponse());
       }),
       baseUri: Uri.parse('https://114-auth.hmac.kr'),
-      keyId: '',
-      keySecret: '',
       tenantSlug: 'hanmac-family',
     );
 
@@ -155,8 +141,6 @@ void main() {
         return _jsonResponse(_orgContextResponse());
       }),
       baseUri: Uri.parse('https://114-auth.hmac.kr'),
-      keyId: '',
-      keySecret: '',
       tenantSlug: 'hanmac-family',
       sessionStore: store,
     );
@@ -173,8 +157,6 @@ void main() {
         return _jsonResponse(_orgContextResponse());
       }),
       baseUri: Uri.parse('https://114-auth.hmac.kr'),
-      keyId: '',
-      keySecret: '',
       tenantSlug: 'hanmac-family',
     );
 
@@ -184,27 +166,22 @@ void main() {
     expect(requestCount, 1);
   });
 
-  test(
-    'falls back to env org-context credential without session credential',
-    () async {
-      final client = OrgContextApiClient(
-        httpClient: MockClient((request) async {
-          expect(request.url.host, 'env.example.test');
-          expect(request.url.queryParameters['tenantSlug'], 'env-family');
-          expect(request.headers['X-Baron-Key-ID'], 'env-key-id');
-          expect(request.headers['X-Baron-Key-Secret'], 'env-key-secret');
-          return _jsonResponse(_orgContextResponse());
-        }),
-        baseUri: Uri.parse('https://env.example.test'),
-        keyId: 'env-key-id',
-        keySecret: 'env-key-secret',
-        tenantSlug: 'env-family',
-        sessionStore: const AuthSessionStore(),
-      );
+  test('uses configured auth-server org-context endpoint without Baron key headers', () async {
+    final client = OrgContextApiClient(
+      httpClient: MockClient((request) async {
+        expect(request.url.host, 'env.example.test');
+        expect(request.url.queryParameters['tenantSlug'], 'env-family');
+        expect(request.headers.containsKey('X-Baron-Key-ID'), isFalse);
+        expect(request.headers.containsKey('X-Baron-Key-Secret'), isFalse);
+        return _jsonResponse(_orgContextResponse());
+      }),
+      baseUri: Uri.parse('https://env.example.test'),
+      tenantSlug: 'env-family',
+      sessionStore: const AuthSessionStore(),
+    );
 
-      await client.fetchOrgContext();
-    },
-  );
+    await client.fetchOrgContext();
+  });
 
   test(
     'remote directory repository filters org-context employees locally',
@@ -215,8 +192,6 @@ void main() {
           return _jsonResponse(_orgContextResponse());
         }),
         baseUri: Uri.parse('https://sadmin.hmac.kr'),
-        keyId: 'key-id',
-        keySecret: 'key-secret',
         tenantSlug: 'hanmac-family',
       );
       final repository = RemoteDirectoryRepository(orgContextApiClient: client);
@@ -238,8 +213,6 @@ void main() {
           return _jsonResponse(_orgContextResponse());
         }),
         baseUri: Uri.parse('https://sadmin.hmac.kr'),
-        keyId: 'key-id',
-        keySecret: 'key-secret',
         tenantSlug: 'hanmac-family',
       );
       final repository = RemoteDirectoryRepository(orgContextApiClient: client);
@@ -264,8 +237,6 @@ void main() {
           return _jsonResponse(_orgContextResponse());
         }),
         baseUri: Uri.parse('https://sadmin.hmac.kr'),
-        keyId: 'key-id',
-        keySecret: 'key-secret',
         tenantSlug: 'hanmac-family',
       );
       final repository = RemoteDirectoryRepository(orgContextApiClient: client);