docs(assurance): ASSURANCE_CASE claims API keys are never stored in config files, but CLI persists api_key to config.json

Summary

ASSURANCE_CASE.md says API keys are read exclusively from environment variables and are never embedded in config files. The CLI actually persists api_key / auth_token into ~/.opencodereview/config.json.

This is a documentation / assurance-case accuracy issue (not an exploitable vulnerability by itself). Config writes use mode 0600, which is good — but the assurance claim as written is incorrect and can mislead security reviewers / consumers of the assurance case.

Evidence (static, against main)

ASSURANCE_CASE.md claims

• Threat T2: Keys read from environment variables only; never logged, written to output files
• Fail-safe defaults: API keys must be explicitly provided via environment variables
• OWASP A07 row: API keys are read exclusively from environment variables, never embedded in code or config files, never logged

Source: https://github.com/alibaba/open-code-review/blob/main/ASSURANCE_CASE.md

Product behavior

• CLI example: ocr config set providers.anthropic.api_key "$ANTHROPIC_API_KEY"
• ProviderEntry includes api_key JSON field
• LlmConfig includes auth_token JSON field
• Config path defaults to ~/.opencodereview/config.json and is saved via saveConfig

Source: https://github.com/alibaba/open-code-review/blob/main/cmd/opencodereview/config_cmd.go

Proposed fix

Update ASSURANCE_CASE.md (and any mirrored claims) to document the real model:

1. Keys may come from env vars, api_key_cmd / auth_token_cmd, or the user config file
2. When stored in config, files are written with restrictive permissions (0600)
3. Keys must not be logged / echoed in cleartext (masking already exists for config set display)

Optional: a one-line README security note pointing to the same precedence.

AI disclosure

Assisted by passive static analysis tooling; all claims verified against public source on GitHub. I reviewed the evidence myself.

Request

Please assign this issue to me (@Erebuzzz) before I implement so we avoid duplicate work. Happy to open a focused docs/ PR after assignment.