fix(mem0-plugin): resolve API key from userConfig, fix #4876

Root cause: .mcp.json required ${MEM0_API_KEY} shell env var which
OAuth flow never populates — MCP server never started, only auth
stubs were exposed.

Fix: switch .mcp.json to ${user_config.MEM0_API_KEY} so Claude Code
reads the key from plugin userConfig (system keychain). Add
resolve_api_key() fallback chain (MEM0_API_KEY -> CLAUDE_PLUGIN_OPTION_MEM0_API_KEY)
to all hook scripts. Update onboard skill and setup_coding_categories.py
to handle keychain-only users. Add 3 tests for key resolution.

mem0-plugin/scripts/_identity.py

@@ -1,6 +1,10 @@
-"""Resolve mem0 user_id.
+"""Resolve mem0 identity: API key and user_id.
 
-Resolution priority:
+API key resolution (first non-empty wins):
+  1. MEM0_API_KEY env var (explicit / shell profile)
+  2. CLAUDE_PLUGIN_OPTION_MEM0_API_KEY (set by Claude Code userConfig)
+
+User ID resolution:
   1. MEM0_USER_ID env var (explicit override)
   2. $USER, else "default"
 """
@@ -10,6 +14,13 @@ from __future__ import annotations
 import os
 
 
+def resolve_api_key() -> str:
+    key = os.environ.get("MEM0_API_KEY", "").strip()
+    if key:
+        return key
+    return os.environ.get("CLAUDE_PLUGIN_OPTION_MEM0_API_KEY", "").strip()
+
+
 def resolve_user_id() -> str:
     explicit = os.environ.get("MEM0_USER_ID", "").strip()
     if explicit: