fix(trello): refresh API key link + stop stuck 'Waiting' spinner

[jkwiecien-solvd]

Two small fixes to the Trello provider OAuth step.

1. Obsolete API key link

The wizard showed "Find your API key at trello.com/app-key". That page is obsolete — Trello API keys are now managed at https://trello.com/power-ups/admin/.

• Update the wizard link in oauth-step.tsx.
• Update a stale reference to the same obsolete URL in a code comment (credentials.ts).

2. Stuck "Waiting..." spinner after manual token entry

Repro: enter API key → click Authorize (popup opens) → grant access → paste the returned token into "Enter token manually". The UI switches to "Token set" but the "Waiting..." spinner keeps spinning next to it.

Cause: isWaitingForAuth was only cleared when the popup window closed. If the user pasted the token while the popup was still open, the waiting state never reset.

Fix: clear isWaitingForAuth as soon as a token is present.

🤖 Generated with Claude Code

[nhopeatall]

Summary

The Trello UI/code-comment changes look correct, but this PR currently fails the required lint-and-test workflow in the production dependency audit.

Code Issues

Blocking

• CI: lint-and-test / Audit production dependencies — GitHub reports this workflow as failed for head 15961cb, and cascade-tools scm get-ci-run-logs shows the failed step is Audit production dependencies. I reproduced the exact workflow command locally with npm audit --omit=dev --audit-level=high; it exits 1 because production dependencies include a high-severity @grpc/grpc-js advisory (GHSA-5375-pq7m-f5r2 / GHSA-99f4-grh7-6pcq). Please update the affected production dependency chain or otherwise make the audit pass before merge.

Verified locally: npx vitest run --project unit-core tests/unit/web/trello-oauth-step.test.ts, npm run typecheck, and npm test all pass. npm run lint exits 0, with pre-existing warnings outside this PR's changed files.

🕵️ codex · gpt-5.5 · run details

[zbigniewsobiecki]

The URL fixes are spot on — and thanks for catching the stale comment in credentials.ts too; that covers every occurrence in the repo.

One finding on the spinner fix: clearing isWaitingForAuth whenever a token is present suppresses the waiting state for the Re-authorize path. With a token already set, clicking Re-authorize sets isWaitingForAuth(true), but the old token is still in state, so the new effect clears it on the next render — the "Waiting..." spinner and the "After clicking Allow… paste the token" helper text (both gated on isWaitingForAuth) never show during re-auth.

The completion signal is really the token changing, not being present. Suggest clearing in the manual input's onChange instead — the only path a token can arrive through while waiting:

onChange={(e) => {
    dispatch({ type: 'SET_TRELLO_TOKEN', value: e.target.value });
    if (e.target.value && isWaitingForAuth) setIsWaitingForAuth(false);
}}

That fixes your repro and keeps the re-auth waiting indicator meaningful. Happy to merge once that's in.

(Heads-up: the earlier lint-and-test failure was not your change — an npm audit high advisory on a transitive dep, fixed on dev today. I've updated your branch, so CI should be green apart from this review.)