🤖 fix: a Daytona setConfig call without an API key still logs every sandbox out of ssh #7462

Follow-up from the Codex review of #7100 (thread: #7100 (comment), src/node/services/daytona/daytonaAccount.ts:91).

Problem

The daytona.setConfig schema says an omitted apiKey leaves the key unchanged, and DaytonaCredentialsStore.update({}) writes nothing. DaytonaAccount.setConfig still runs the settings-change cleanup after it: it drops readiness, removes every Xum alias from the ssh include file and revokes the cached tokens. So an API caller that sends {} (for example xum api) logs every running Daytona workspace out of external editors and raw ssh until the next readiness check mints new tokens. The settings page always sends apiKey, so the app itself does not hit this.

Proposed fix

Either skip onSettingsChange when the patch leaves the key unchanged (no apiKey, or the same key), or make apiKey required in the schema and drop the "omitted = unchanged" case. Add a test that setConfig({}) keeps the include file's aliases and revokes nothing.

Why it is deferred

#7100 runs its review loop under a P0/P1-only rule; P2 findings get a tracked follow-up. No caller in the app sends a patch without apiKey.