CTX7-3143: Copilot plugin sends the API key outside Authorization so OAuth can run

[enesgules]

Summary

Replaces #3233 with a smaller fix that keeps both sign-in paths.

• The Copilot CLI plugin now sends the key as Context7-API-Key: ${CONTEXT7_API_KEY:-} instead of Authorization: ${CONTEXT7_API_KEY:-}.
• Users without a key can sign in with OAuth. Users who export CONTEXT7_API_KEY keep working with no change on their side.
• Plugin version 1.0.4 (plugin.json and the marketplace manifest). README has one "Authentication" section with both methods.

Why not #3233 as it was

#3233 removed the header, so API-key users would have to configure Context7 as a manual MCP server. Its premise was also only half right. Tested with Copilot CLI 1.0.61 against a local mock that answers with the same 401 challenge as our server:

Plugin config	CONTEXT7_API_KEY	First request Authorization	Starts OAuth	After sign-in
Authorization: ${CONTEXT7_API_KEY:-} (master)	unset	""	yes	still "" → "Failed to connect"
same	set	the key	no	connected
no headers (#3233)	unset	absent	yes	Bearer <token> → connected
Context7-API-Key: ${CONTEXT7_API_KEY:-} (this PR)	unset	absent	yes	Bearer <token> → connected
same	set	absent, key in Context7-API-Key	no	connected

So Copilot CLI does start OAuth after the 401, but it merges static headers over the OAuth token, and the empty Authorization wins. Moving the key to its own header removes the collision. Copilot CLI has no conditional-header syntax (only $VAR, ${VAR}, ${VAR:-default}).

The hosted server already reads Context7-API-Key and ignores an empty value (packages/mcp/src/index.ts, extractApiKey). Checked on production: an empty header is treated as no key, and a dummy key in that header returns "Invalid API key".

This matters before /mcp moves from observe to required: on master, a Copilot plugin user without a key cannot connect at all once auth is required.

Notes for reviewers

• The mock test used header name CONTEXT7_API_KEY for the last two rows; the header was then renamed to the hyphen form the server lists in its allowed headers. Both names are read by the same extractApiKey and both were checked on production.
• Not verified: a real Clerk sign-in from Copilot CLI against production in required mode, installation from the marketplace (the test used --plugin-dir), other Copilot CLI versions.
• plugin-manifests.test.ts asserts the new header. 342 CLI tests pass.

Closes CTX7-3143

[linear-code]

CTX7-3143