fix(render): accept pasted credential shapes and keep the site up

A hand-pasted OPENCODE_AUTH_JSON can arrive quoted, escaped, double-encoded, or as a bare key; all of those now parse. An invalid secret is logged and the server keeps running, so the sample and connection screen stay available instead of the instance crash-looping.