AUR-390: Blizzard API provider scaffold + doctor

[aurokin]

Summary

Scaffold slice of the Blizzard Battle.net WoW API provider (AUR-390): a new blizzard-api package and blizzard CLI exposing a doctor-only command plus auth posture. This validates the shared OAuth client-credentials architecture (phase 3, docs/architecture/AUTH_ARCHITECTURE.md) as a second auth point alongside warcraftlogs, without yet shipping Game Data / Profile endpoints.

What's included

• blizzard doctor — reports install state, OAuth client-credentials auth posture, capability metadata, and a configured (but deferred-routing) region.
• Auth discovery — credential resolution across .env.local > provider env file > process environment, resolved per key so each credential half is attributed to the source that supplied it. credential_source is the file path when both halves share a source, "environment" for process env, "mixed" when split, None when unconfigured. Reads are pure — no os.environ mutation, and credentials are never emitted in output.
• Wrapper registration — honest capability metadata (doctor=ready; search/resolve/game_data/profile=coming_soon), expansion_mode=none, surfaced through the warcraft blizzard passthrough and surface filtering.
• Boundaries — import-linter keeps the provider independent and correctly layered; the wrapper declares its new blizzard-api-cli dependency.
• Docs + changelog — docs/blizzard-api/README.md scaffold section; CHANGELOG.md Unreleased entry.
• Tests — tests/test_blizzard_api_cli.py covers doctor payload, region discovery from env/provider file, per-source credential attribution (environment / file / mixed), and unconfigured state. Wrapper test sets updated for the 10th provider.

Deferred (not in this slice)

Game Data and Profile endpoints, and region/namespace-aware routing, are out of scope for this scaffold and remain to be implemented. Recommend a follow-up issue to track that work.

Design note

A shared read_env_values helper was prototyped in warcraft_core.env then reverted in favor of a provider-local parser in blizzard_api_cli/auth.py, following the repo rule to extract shared helpers only once a second consumer exists. This keeps the core unchanged and the >=0.1.0 floor accurate.

Verification

• make check green — 978 passed, 237 deselected; ruff / mypy / import-linter clean.
• diffwarden --target uncommitted iterated to convergence: codex-gpt54, codex-gpt55, cursor-composer all report no findings (verdict "patch is correct"). One finding declined with documented inline rationale (--expansion with expansion_mode=none mirrors existing simc behavior).

Closes AUR-390

🤖 Generated with Claude Code

[linear]

AUR-390