ProviderAuthOption apiKey auth

Keep provider apiKey sugar and explicit auth mutually exclusive through ProviderAuthOption. Always resolve keys with AuthOptions.bearer(options, "<PROVIDER>_API_KEY"); direct environment reads look simpler but bypass explicit auth overrides and turn missing credentials into runtime crashes instead of typed Authentication errors.