bump version to v1.0.16

[RyanLee-Dev]

Summary

• bump package.json version 1.0.15 → 1.0.16
• expand README OAuth/API key auth section

[github-actions]

placeholder

[github-actions]

Review: Update auth docs + version bump

Summary: README clarification on OAuth vs API-key auth priority, plus a patch version bump. Touched files: only docs and package.json.

---

Checks

Command	Result	Note
bun run typecheck	✅ Pass	No type errors
bun test	✅ Pass	355 tests, 0 failures
bun run lint	🛑 Errors	2 errors, 12 warnings (pre-existing, see below)

---

Issues

None introduced by this PR. The diff is README + version bump only.

Pre-existing lint errors (not blocking this PR, but worth fixing)

File	Issue
test/auth/oauth.test.ts:79	mockDeviceCodeFlow declared but never used
test/sdk/image.test.ts:4	ImageSaveOptions imported but never used
test/sdk/music.test.ts + 5 others	@typescript-eslint/no-explicit-any warnings — should use unknown or a specific type

These errors predate this PR (unrelated files, no changes here). Suggest cleaning them up in a follow-up PR to keep lint green.

---

Verdict

🛑 Request Changes — lint is red due to pre-existing errors in test files. This PR itself introduces no issues, but the codebase cannot merge with lint failures.

Suggested fix: Either (a) suppress the two no-unused-vars errors with eslint-disable comments in those specific lines, or (b) remove the unused declarations. The any warnings are lower priority but should also be addressed before merging.