feat: add Xquik registry entry

[kriptoburak]

Summary

• Add Xquik to the Toolcast registry with its canonical OpenAPI document.
• Configure the current x-api-key authentication metadata.
• Add registry coverage for the new entry.

Independent Repository Fixes

• Preserve an OpenAPI apiKey component key separately from its actual header, query, or cookie parameter name.
• Resolve credentials from the wire-name environment variable and send the spec-defined header.
• Make toolcast serve --api-key use the parsed OpenAPI header instead of hard-coded Authorization.
• Refresh vulnerable transitive packages and correct stale package/bin metadata in package-lock.json.

The live Xquik OpenAPI document declares https://xquik.com as its server and includes /api/v1 in each path, so the registry base URL intentionally remains https://xquik.com.

Validation

• npm run lint
• npm run build
• npm test (37 passing)
• npm audit --audit-level=critical (0 vulnerabilities)
• git diff --check

Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 913df7b8c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[kriptoburak]

Updated the registry entry in 0caa59e.

• Changed authEnvVar to X_API_KEY so the generated config matches Toolcast resolveAuth() for the x-api-key security scheme.
• Rechecked the base URL against the current public OpenAPI schema: servers[0].url is https://xquik.com, and paths include /api/v1/..., so baseUrl: https://xquik.com keeps generated URLs aligned.

Validation:

• npm test registry
• npm run build
• npm run lint

[kriptoburak]

Repair pass complete at b1c6122. Both review threads have direct responses and are resolved. The live OpenAPI server/path combination was reverified, apiKey component-versus-wire-name handling now works generically, the explicit CLI path uses the spec header, and the dependency audit is clean. Local typecheck, build, all 37 tests, and audit pass.

[kriptoburak]

Rebuilt this PR on current main as 1 signed commit while preserving both resolved review outcomes.

The Xquik registry entry still uses the live OpenAPI server and path layout. The independent repair preserves an API-key component key separately from its wire parameter name, resolves the matching environment variable, and sends explicit CLI keys through the spec-defined header. The lockfile also retains the corrected package/bin metadata and audited dependency refresh.

Validated TypeScript lint and build, all 37 tests, a 0-vulnerability npm audit, the live 99-path Xquik OpenAPI server/path/auth contract, and the final diff.