Seats.aero as second AwardProvider (work-2eoa)

[ak2k]

Summary

Adds Seats.aero as a second award-data provider alongside PointsPath. First real second consumer of the AwardProvider Protocol that shipped in work-z6zi — validates the abstraction works.

Closes bd `work-2eoa`.

Why both providers

	PointsPath	Seats.aero
Mileage programs	~17 for Pro tier (US-focused)	25+ including Smiles, Aeroplan, Flying Blue, Qatar, LifeMiles, Virgin Atlantic, etc.
Flight-level detail	Yes (carrier × cabin fan-out)	Yes (with `include_trips=true`)
Bank transfer-partners	✅ "funded by: Chase, Bilt, Amex"	❌
Per-cabin valuation	✅ `millsToCashRatio` per program	❌ (column renders as "—")
Cost per query	N airlines × M cabins parallel requests	1 bulk request

The bank-partner + valuation gaps are intentional — bd work-rq94 + work-eb7k cover those as separate workstreams.

Surface

```bash
flight auth seats key <pro_xxxxxxxx> # save key (0600 perms)
flight auth seats whoami # probe quota
flight auth seats logout # delete file

flight search JFK LHR --dep ... --providers seats # seats only
flight search JFK LHR --dep ... --providers pp,seats # both
flight search JFK LHR --dep ... --provider-opt seats.sources=american,united
```

Key resolution: `SEATS_AERO_API_KEY` env > `~/.config/flight-cli/seats.json` > none. Env path is right for sops/direnv flows; the on-disk path is "save once" convenience.

Implementation

```
src/flight_cli/providers/seats_aero/
auth.py # env > file > None resolver, 0600 save, get/clear
models.py # pydantic for /partnerapi/search (PascalCase mirror)
client.py # async httpx wrapper; X-RateLimit-* tracking; pagination
provider.py # AwardProvider impl; trip → AwardFlight grouping
```

Grouping key for trips → AwardFlights: `(FlightNumbers, DepartsAt, Source)`. Same physical journey priced in Y/W/J/F under the same program collapses into one AwardFlight with multiple CabinAward entries. Different connecting segments (e.g. AA2643→AA730 vs AA2643→AA732) stay distinct.

The PP code path (`run_pp_for_search`) is generalized to gate token validation on whether PP is actually in the filter — so `--providers seats` no longer hard-errors when PP tokens are missing.

Test plan

• 265 tests pass (33 new: `tests/seats_aero/test_{auth,models,provider}.py`)
• Basedpyright clean: `0 errors, 0 warnings, 0 notes`
• Ruff clean
• Live smoke against real API: `flight search JFK LHR --dep 2026-08-15 --backend gflight --providers seats` joins Flying Blue, Smiles, Qatar, American, Virgin Atlantic awards against the gflight cash table on flight#+date. ¢/mi computed where the cabin matches.
• Fixtures captured from real responses (5 results with `include_trips=false` and `include_trips=true`) — pinned at `tests/fixtures/seats_aero/` so seats.aero schema drift becomes a loud test failure.

Quota note

Seats.aero Pro tier is 1000 requests/day. `flight auth seats whoami` probes the current remaining count via `X-RateLimit-Remaining`. The provider does one bulk request per leg per search — far fewer than PP's N × M fan-out.