fix: scope OAuth resource URL to OAuth credentials

[ch-z-hc]

Bug

With OAuth credentials saved in config.json, --api-key correctly selects the supplied key, but loadConfig() still takes the base URL from oauth.resource_url. An explicit --region global or --region cn therefore does not select that region's API host unless the user also supplies a base URL.

Fix

Only use the saved OAuth resource URL when there is no explicit API key. Keep explicit base URL precedence and OAuth's priority over a stored API key unchanged.

Four regression/control cases cover both regions, OAuth with a coexisting stored key, and an explicit base URL. Both regional regressions fail against the unchanged loader and pass with the patch.

Validation

• Bun 1.4.0, Windows and Linux: typecheck passes; lint has no errors and one existing warning in speech.test.ts.
• Loader/resolver tests: 17 pass. Two independent automated blind reviews found no actionable issues; their broader focused runs passed 37 and 59 tests respectively.
• Linux production build, compiled CLI build, and mmx --version pass.
• Full Linux run: 600 passed, 3 failed. The unchanged a965e72 baseline has 596 passed and the same 3 failures: the unreachable-region tests in timeout-fix.test.ts and auth/login.test.ts time out, and the FileSDK upload test sees a loopback base URL instead of the global host. Their root causes are not established here. Both full runs used the same validation-only fetch preload rejecting non-loopback requests; repository tests and timeouts were not changed.

No live MiniMax model/API calls were used to validate this fix. Implemented and tested with Codex assistance; the blind reviews were automated, not independent human review.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}

[NianJiuZst]

Reviewed commit dc61fe89df77f6e7aebe6205202b3cedeb4f478c. No blocking findings; I recommend merging.

The loader now correctly excludes the saved OAuth resource URL when an explicit API key selects API-key authentication. Explicit base-URL overrides retain precedence, and OAuth still wins over a stored API key when no explicit key is supplied.

I independently verified that the two regional regressions fail on unchanged main (8668aa5) and pass with this patch. All 17 loader/resolver tests pass, including the OAuth-plus-stored-key and custom-base-URL controls. Type checking and lint pass, with the existing unrelated warning in test/sdk/speech.test.ts. The CI workflow for this exact head also passes.

[NianJiuZst]

Approve