feat: inject API key from environment variable when config's apiKey is empty

[Guo-Zhang]

Motivation

Storing plain-text API keys in config.json is a security concern, especially in shared or CI environments. Many users already have API keys set as environment variables (e.g. DEEPSEEK_API_KEY, OPENAI_API_KEY).

Proposal

When a provider's apiKey is empty in config.json, fall back to environment variables before marking the config as incomplete:

1. {PROVIDER_ID}_API_KEY (uppercased, dashes → underscores) — e.g. DEEPSEEK_V4_FLASH_API_KEY
2. The config file's apiKey field remains empty — no keys written to disk

A reference implementation is available on the quanttide/iceCoder fork: feat/env-api-key-injection branch.

Questions for discussion

• Should there be a generic fallback like OPENAI_API_KEY / DEEPSEEK_API_KEY in addition to the ID-specific one?
• Should the Web UI's config page indicate when a key is sourced from env rather than the config file?
• Should the config readiness check (isAppConfigReady) also consider env vars?

Prior art

• Claude Code reads ANTHROPIC_API_KEY from env
• OpenAI's official SDKs read OPENAI_API_KEY from env
• iceCoder's DEFAULT_CONFIG already has a placeholder pattern (sk-your-api-key-here)

[lbiceman]

I'll consider this issue and get back to you once I've wrapped up my current tasks.

[lbiceman]

Thanks for the suggestion! This is now implemented: when a provider's apiKey in config.json is empty or a placeholder, iceCoder falls back to {PROVIDER_ID}_API_KEY (e.g. DEEPSEEK_V4_FLASH_API_KEY) and then a vendor-level {VENDOR}_API_KEY derived from the apiUrl host (e.g. DEEPSEEK_API_KEY), without ever writing the key to disk.

The readiness/Setup Gate check and the Web config page both recognize env-sourced keys (shown as apiKeySource: "env"), and usage docs are updated in docs/环境变量.md.