# Real-Debrid OAuth → API Key Switch

## Problem
The CF Worker auth system routes Real-Debrid and Premiumize through OAuth device code flow, calling `api.real-debrid.com/oauth/v2/device/code`. This endpoint returned HTTP 404 or 403 — the registered OAuth client ID (`X245A4XAIBGVM` or similar) may not be valid or the endpoint format changed.

## Solution
Switch **all** debrid providers to API key entry (no OAuth device code flow). Users get their API key from the provider's website (e.g., `https://real-debrid.com/apitoken`) and paste it into the QR form.

### Worker changes (index.ts):
```typescript
// Before: separate OAuth and key providers
const oauthServices = ["realdebrid", "premiumize"];
const keyServices = ["torbox", "alldebrid", "debrider", "offcloud"];

// After: all providers use key-based auth
const allProviders = ["realdebrid", "premiumize", "torbox", "alldebrid", "debrider", "offcloud"];
if (allProviders.includes(providerId)) return handleKeyStart(providerId, env);
```

### DO changes (auth_session_do.ts):
```typescript
// handleKeyStart now accepts all 6 providers:
const valid = ["realdebrid", "premiumize", "torbox", "alldebrid", "debrider", "offcloud"];
```

### Form page changes (index.ts handleAuthForm):
```typescript
// Before: branches on authType for OAuth vs key form
if (s.authType === "oauth") return html(renderOAuthPage(...));

// After: always show API key form
return html(renderApiKeyForm({ ... }));
```

### Polling changes (index.ts handleAuthStatus):
```typescript
// Before: OAuth sessions trigger poll → external API call
if (s.authType === "oauth" && s.status === "active") {
    const r2 = await stub.fetch(...);
    s = await r2.json() as any;
}

// After: no OAuth polling needed — removed
```

## Why this works
- Real-Debrid API token can be found at https://real-debrid.com/apitoken
- The API token works for all RD API calls (unrestrict, torrents, account info)
- No OAuth device code registration needed
- Simpler implementation, fewer moving parts
- NuvioTV already uses API key entry for RD (DebridApiKeyDialog)