Error messages for auth setup failures are cryptic #33

Description

When API key configuration fails (wrong key format, expired key, wrong provider), the error messages don't clearly indicate:

1. Which provider the key was tried against
2. What format the key should be in
3. How to verify the key independently
4. Where to get a new key

Users report confusion when their OpenRouter key is tried against OpenAI, or vice versa.

Impact

Medium — First-time setup friction. Users waste time debugging auth issues.

Suggested Fix

• Include provider name in all auth error messages
• Add a ironclaw doctor auth subcommand that validates each configured key
• Show expected key prefix (e.g., 'OpenAI keys start with sk-...')
• Link to provider-specific setup docs in error messages