chore: v2.8.16 — Oh My Pi login sharing: a pane's key is listed before it starts

omp's gateway re-reads its clients file only every 10 s, and an omp that
starts while its key is refused fails model discovery once and hangs for
good. omp-share.js now keeps four keys queued in the clients file (hashes
only; the keys in <data dir>/omp-share/tokens.json, 0600): a new pane takes
one already listed (AGENTHUB_OMP_KEY), a fresh one joins the queue, and a
gone pane's key leaves at the next sync.

docs/SERVER-MODE.md

@@ -553,14 +553,18 @@ omp login            # e.g. anthropic
 - A member's omp pane gets one provider `agenthub` in its
   `~/.omp/agent/models.yml` (written as the member; the rest of the file is
   kept, a file that is not a YAML mapping is left alone), pointing at the
-  gateway with `apiKey: AGENTHUB_PANE_TOKEN` — the NAME of the env var holding
-  its pane token — and `OMP_SKIP_SETUP=1`. It runs on `--model agenthub/<model>`:
+  gateway with `apiKey: AGENTHUB_OMP_KEY` — the NAME of the env var holding
+  the pane's key — and `OMP_SKIP_SETUP=1`. It runs on `--model agenthub/<model>`:
   the model picked in AgentHub, else the host's own `modelRoles.default`
   (`~/.omp/agent/config.yml`) — left to itself omp would take the provider's
-  first listed model, a retired one the API answers 404 for. The clients file lists the SHA-256
-  of each LIVE omp pane's token (rewritten every 15 s; the gateway re-reads it
-  every 10 s), so a token stops working shortly after its pane ends, and
-  turning sharing off empties it at once.
+  first listed model, a retired one the API answers 404 for.
+- The gateway re-reads its clients file only every 10 s, and an omp that
+  starts while its key is still refused hangs for good. So AgentHub keeps four
+  keys QUEUED in the clients file (hashes only; the keys themselves in
+  `<data dir>/omp-share/tokens.json`, 0600): a new pane takes one that is
+  already listed, and a fresh key joins the queue. A pane's key leaves the
+  file at the first sync (every 15 s) after its pane is gone, and turning
+  sharing off empties both files at once.
 - A scoped client token calls models only: it cannot read a credential, the
   gateway's usage or credential health, and refresh tokens never leave the
   broker. Host panes use the host's login directly and get nothing new.