Share configured LLM secret extraction across diagnostics paths

internal/framework/llm/secrets.go

@@ -0,0 +1,17 @@
+package llm
+
+import "gitea.maximumdirect.net/eric/audita/internal/core/config"
+
+// ConfiguredSecrets returns all configured LLM API-key values that should be
+// redacted from diagnostics and surfaced error payloads.
+func ConfiguredSecrets(cfg *config.Config) []string {
+	if cfg == nil {
+		return nil
+	}
+	effectiveValidation := cfg.EffectiveValidationLLMConfig()
+	return []string{
+		cfg.PrimaryLLM.APIKey,
+		cfg.ValidationLLM.APIKey,
+		effectiveValidation.APIKey,
+	}
+}