Refuse an empty credential value instead of dialing with it

[GeiserX]

A GraphQL connection whose required credential input is present but empty is dialed anyway:

// packages/plugins/graphql/src/sdk/plugin.ts
).filter((variable) => credential.values[variable] == null);

== null catches null and undefined, so "" counts as supplied. Omitting the input and supplying
it as "" are the same state — there is no usable credential — but they behave differently:

required input b	before
omitted	refused, connection_value_missing, naming b
""	request sent with an empty team_id=
"team_1"	request sent (correct)

In the empty case the request goes out, the upstream answers 401, and the operator is told
authentication failed — not that their credential is empty, and not which input to fix.

Why this reads as an inconsistency rather than a decision

The OpenAPI backing already refuses an empty value, at both of its checks:

// packages/plugins/openapi/src/sdk/backing.ts
const value = input.credential.values[name];
return value == null || value === "";

So the rule already exists in this codebase — including in this very file, where
missingCredentialVariables already applies it on the health-check path. What it does not cover is
the invocation path, which is the line this change touches. The inconsistency is internal to the
plugin rather than between plugins.

It matters most where a provider resolves the value rather than a person typing it. A store that
returns "" for a key it holds but cannot resolve is exactly the case worth catching, and forwarding
the empty value hides the cause behind an upstream auth error.

Scope

Whitespace is deliberately left alone. Judging a value someone supplied is a different decision from
judging one that is absent, and OpenAPI does not trim either — so this stays with the rule already
established rather than inventing a new one.

Tests

The new case in multi-placement-auth.test.ts fails without the change and passes with it; the three
existing cases that dial with real values are the control. 98 passed for the package.

Not included here: the same one-line gap exists on the MCP plugin's invocation path (the
credential.values[variable] == null filter in packages/plugins/mcp/src/sdk/plugin.ts). #1582 adds
the equivalent gate to that plugin's health check, so this half sits more naturally alongside it than
here — happy to fold it in wherever you would rather have it.

Part of the review in #1585; see #1564 for the first of this series.