test(cli): cover the keyless token record and keep keyring to the cli extra

`lite up` treats a token record whose key the keychain would not hand over as no
login at all, and that clause had no test: every existing freshness test passed a
record carrying a real key, so deleting the clause left the whole suite green

The base install smoke check now also asserts keyring is absent, which is what
makes the lazy import in cli_keyring meaningful. keyring ships in the cli extra
only, so a plain `pip install litellm` must not be able to reach it

tests/base_sdk_tests/check_base_sdk_install.py

@@ -11,7 +11,7 @@ import sys
 import traceback
 from collections.abc import Callable
 
-EXTRAS_ONLY_MODULES = ("fastapi", "uvicorn")
+EXTRAS_ONLY_MODULES = ("fastapi", "uvicorn", "keyring")
 
 
 def _require(condition: bool, message: str) -> None:

tests/test_litellm/proxy/client/cli/test_up_commands.py

@@ -262,6 +262,28 @@ class TestEnsureFreshLogin:
 
         assert login_calls == ["http://proxy-b:4000"]
 
+    def test_forces_a_fresh_login_when_the_cached_token_has_no_readable_key(self, monkeypatch):
+        monkeypatch.setattr(up_module.sys.stdin, "isatty", lambda: True)
+        tokens = iter(
+            [
+                _token(None, "http://proxy-a:4000"),
+                _token("sk-a", "http://proxy-a:4000"),
+            ]
+        )
+        monkeypatch.setattr(up_module, "load_cli_token", lambda **_: next(tokens))
+        monkeypatch.setattr(up_module, "is_cli_token_fresh", lambda token_data: True)
+        login_calls = []
+
+        @click.pass_context
+        def fake_login(ctx):
+            login_calls.append(ctx.obj["base_url"])
+
+        monkeypatch.setattr(up_module, "login", fake_login)
+
+        _ensure_fresh_login(_make_ctx("http://proxy-a:4000"))
+
+        assert login_calls == ["http://proxy-a:4000"]
+
     def test_fails_cleanly_non_interactively_when_only_a_different_proxys_token_is_cached(self, monkeypatch):
         monkeypatch.setattr(up_module.sys.stdin, "isatty", lambda: False)
         monkeypatch.setattr(up_module, "load_cli_token", lambda **_: _token("sk-a", "http://proxy-a:4000"))