Simplify auth modes to Anthropic and Bedrock, fix Windows taskbar icon

Replace the three auth modes (Login, API Key, Bedrock) with two
(Anthropic, Bedrock). The Anthropic mode uses OAuth via `claude login`
inside the terminal, which generates and stores its own API key in the
persistent config volume. The separate API Key mode is removed because
Claude Code now requires interactive approval of externally-provided
keys, making the injected ANTHROPIC_API_KEY approach unreliable.

Old projects stored as "login" or "api_key" are automatically migrated
to "anthropic" via serde aliases.

Also fix the Windows taskbar icon showing as a black square by loading
icon.png instead of icon.ico for the runtime window icon.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/src-tauri/src/commands/project_commands.rs

@@ -126,12 +126,7 @@ pub async fn start_project_container(
 
     // Get API key only if auth mode requires it
     let api_key = match project.auth_mode {
-        AuthMode::ApiKey => {
-            let key = secure::get_api_key()?
-                .ok_or_else(|| "No API key configured. Please set your Anthropic API key in Settings.".to_string())?;
-            Some(key)
-        }
-        AuthMode::Login => {
+        AuthMode::Anthropic => {
             None
         }
         AuthMode::Bedrock => {

app/src-tauri/src/lib.rs

@@ -43,7 +43,7 @@ pub fn run() {
             exec_manager: ExecSessionManager::new(),
         })
         .setup(|app| {
-            match tauri::image::Image::from_bytes(include_bytes!("../icons/icon.ico")) {
+            match tauri::image::Image::from_bytes(include_bytes!("../icons/icon.png")) {
                 Ok(icon) => {
                     if let Some(window) = app.get_webview_window("main") {
                         let _ = window.set_icon(icon);

app/src-tauri/src/models/project.rs

@@ -46,20 +46,21 @@ pub enum ProjectStatus {
 }
 
 /// How the project authenticates with Claude.
-/// - `Login`: User runs `claude login` inside the container (OAuth, persisted via config volume)
-/// - `ApiKey`: Uses the API key stored in the OS keychain
+/// - `Anthropic`: User runs `claude login` inside the container (OAuth via Anthropic Console,
+///   persisted in the config volume)
 /// - `Bedrock`: Uses AWS Bedrock with per-project AWS credentials
 #[derive(Debug, Clone, Serialize, Deserialize, PartialEq)]
 #[serde(rename_all = "snake_case")]
 pub enum AuthMode {
-    Login,
-    ApiKey,
+    /// Backward compat: old projects stored as "login" or "api_key" map to Anthropic.
+    #[serde(alias = "login", alias = "api_key")]
+    Anthropic,
     Bedrock,
 }
 
 impl Default for AuthMode {
     fn default() -> Self {
-        Self::Login
+        Self::Anthropic
     }
 }