fix: wire gateway auth diagnostics into doctor

src/config/config.test.ts

@@ -710,6 +710,30 @@ describe("legacy config detection", () => {
     }
   });
 
+  it("rejects gateway.token", async () => {
+    vi.resetModules();
+    const { validateConfigObject } = await import("./config.js");
+    const res = validateConfigObject({
+      gateway: { token: "legacy-token" },
+    });
+    expect(res.ok).toBe(false);
+    if (!res.ok) {
+      expect(res.issues[0]?.path).toBe("gateway.token");
+    }
+  });
+
+  it("migrates gateway.token to gateway.auth.token", async () => {
+    vi.resetModules();
+    const { migrateLegacyConfig } = await import("./config.js");
+    const res = migrateLegacyConfig({
+      gateway: { token: "legacy-token" },
+    });
+    expect(res.changes).toContain("Moved gateway.token → gateway.auth.token.");
+    expect(res.config?.gateway?.auth?.token).toBe("legacy-token");
+    expect(res.config?.gateway?.auth?.mode).toBe("token");
+    expect((res.config?.gateway as { token?: string })?.token).toBeUndefined();
+  });
+
   it('rejects telegram.dmPolicy="open" without allowFrom "*"', async () => {
     vi.resetModules();
     const { validateConfigObject } = await import("./config.js");

src/config/legacy.ts

@@ -60,6 +60,11 @@ const LEGACY_CONFIG_RULES: LegacyConfigRule[] = [
     message:
       "agent.imageModelFallbacks was replaced by agent.imageModel.fallbacks (run `clawdbot doctor` to migrate).",
   },
+  {
+    path: ["gateway", "token"],
+    message:
+      "gateway.token is ignored; use gateway.auth.token instead (run `clawdbot doctor` to migrate).",
+  },
 ];
 
 const LEGACY_CONFIG_MIGRATIONS: LegacyConfigMigration[] = [
@@ -154,6 +159,34 @@ const LEGACY_CONFIG_MIGRATIONS: LegacyConfigMigration[] = [
       }
     },
   },
+  {
+    id: "gateway.token->gateway.auth.token",
+    describe: "Move gateway.token to gateway.auth.token",
+    apply: (raw, changes) => {
+      const gateway = raw.gateway;
+      if (!gateway || typeof gateway !== "object") return;
+      const token = (gateway as Record<string, unknown>).token;
+      if (token === undefined) return;
+
+      const gatewayObj = gateway as Record<string, unknown>;
+      const auth =
+        gatewayObj.auth && typeof gatewayObj.auth === "object"
+          ? (gatewayObj.auth as Record<string, unknown>)
+          : {};
+      if (auth.token === undefined) {
+        auth.token = token;
+        if (!auth.mode) auth.mode = "token";
+        changes.push("Moved gateway.token → gateway.auth.token.");
+      } else {
+        changes.push("Removed gateway.token (gateway.auth.token already set).");
+      }
+      delete gatewayObj.token;
+      if (Object.keys(auth).length > 0) {
+        gatewayObj.auth = auth;
+      }
+      raw.gateway = gatewayObj;
+    },
+  },
   {
     id: "telegram.requireMention->telegram.groups.*.requireMention",
     describe: