fix: honor XDG_CONFIG_HOME, XDG_DATA_HOME, and OpenCode env overrides

[marcusolsson]

Problem

The CLI hardcoded OpenCode config and auth paths, ignoring the XDG base directory spec and OpenCode's own env overrides:

• Config dir was always ~/.config/opencode — ignored XDG_CONFIG_HOME and OPENCODE_CONFIG_DIR
• Auth file was always ~/.local/share/opencode/auth.json — ignored XDG_DATA_HOME
• OPENCODE_CONFIG (single-file override) was not checked
• Auth path used string concatenation with forward slashes instead of path.join()

OpenCode resolves these via the xdg-basedir package, which has no Windows-specific branch — the same rules apply on all platforms. Hardcoding the paths breaks users who relocate XDG dirs (common on Windows too).

Changes

• New: src/commands/code/xdg-paths.ts — centralized path resolver

  • getOpencodeConfigDir() — honors OPENCODE_CONFIG_DIR, then XDG_CONFIG_HOME, then ~/.config/opencode
  • getOpencodeDataDir() — honors XDG_DATA_HOME, then ~/.local/share/opencode
  • resolveGlobalConfigPath() — honors OPENCODE_CONFIG env var
  • getOpencodeAuthPath() — uses path.join() for correct separators on Windows

• Updated: src/commands/code/opencode.ts — uses new resolvers for config dir, agents dir, and global config file

• Updated: src/commands/code/auth-sync.ts — uses new resolver for auth file, replaces string concat with path.join()

Verification

All 223 tests pass.

Checklist

• Resolve config directory via XDG_CONFIG_HOME / homedir + /.config on all platforms
• Use language path-join instead of string concatenation
• Target the config directory for opencode.json, not the data directory
• Honor OPENCODE_CONFIG (single-file override)
• Honor OPENCODE_CONFIG_DIR (directory override for agents/commands/plugins)
• Support both opencode.json and opencode.jsonc