fix: refresh Pi credential readiness

backend/src/pi/management.ts

@@ -117,7 +117,7 @@ export function createPiManagement(config: AppConfig, deps: PiManagementDeps): P
       return piProviderCredentialStatus({
         provider,
         authProviders: loadPiAuthProviders(),
-        credentialValue: secretValue(config, "THT_MODEL_API_KEY"),
+        resolveCredentialValue: () => secretValue(config, "THT_MODEL_API_KEY"),
         credentialFile: config.modelApiKeyFile,
       });
     } catch {

backend/src/pi/provider-credentials.ts

@@ -179,7 +179,7 @@ export function buildPiChildEnv(opts: {
 export function piProviderCredentialStatus(opts: {
   provider?: string;
   credentialFile?: string;
-  credentialValue?: string;
+  resolveCredentialValue?: () => string | undefined;
   authProviders?: ReadonlySet<string>;
   fsOps?: CredentialFsOps;
 }): PiCredentialStatus {
@@ -187,7 +187,14 @@ export function piProviderCredentialStatus(opts: {
   if (!provider || LOCAL_PROVIDERS.has(provider)) return "missing";
   if (opts.authProviders?.has(provider)) return "present";
   try {
-    buildPiChildEnv({ ...opts, ambient: {} });
+    buildPiChildEnv({
+      ambient: {},
+      provider,
+      credentialFile: opts.credentialFile,
+      credentialValue: opts.resolveCredentialValue?.(),
+      authProviders: opts.authProviders,
+      fsOps: opts.fsOps,
+    });
     return "present";
   } catch {
     return "missing";