fix(opensky): load OAuth credential files and retire Basic auth (#1229)

Read OpenSky OAuth credentials from OPENSKY_CREDENTIALS_FILE and stop sending retired Basic authentication. Update setup diagnostics and guidance.

Keep credential-file warnings free of parser excerpts and filesystem error details, cover both failure paths with a regression test, and use a launcher-compatible absolute path example.

Original contribution by quanticsoul4772, with credential-warning and documentation follow-up by Sameh Khamis.

Co-authored-by: quanticsoul4772 <[email protected]>
Co-authored-by: Sameh Khamis <[email protected]>

.env.example

@@ -115,7 +115,8 @@ GEMINI_LIVE_MODEL=gemini-3.8-live
 # Client Token). Client-exposed by design, like GOOGLE_MAPS_API_KEY.
 MAPILLARY_CLIENT_TOKEN=
 
-# Optional: OpenSky auth mode (oauth | basic | auto | anon)
+# Optional: OpenSky auth mode (oauth | auto | anon). OpenSky retired
+# username/password (basic) sign-in on 2026-03-18; "basic" now loads anonymously.
 # Default: oauth — requires client credentials below
 # Set to "anon" to skip aircraft auth (rate-limited but works)
 OPENSKY_AUTH_MODE=oauth
@@ -128,7 +129,9 @@ OPENSKY_CLIENT_SECRET=
 # Optional paid Patreon tokens raise request limits; there is no free API key.
 LL2_API_TOKEN=
 
-# Optional: OpenSky credentials JSON file path (alternative to above)
+# Optional: OpenSky credentials JSON file path, used when the two values above
+# are empty: the credentials.json your OpenSky account page downloads when you
+# create an API client. Use an absolute path for compatibility with launchers.
 # OPENSKY_CREDENTIALS_FILE=/path/to/credentials.json
 
 # Optional: dev server config