Document optional API key environment behavior

backends.go

@@ -30,9 +30,12 @@ type Backend struct {
 	// requires an absolute HTTP or HTTPS URL with a host and without user
 	// information, a query string, or a fragment. Paths are allowed.
 	Endpoint string
-	// APIKeyEnv optionally names the environment variable containing the API
-	// key. NewEngine trims it and requires the portable form
-	// [A-Za-z_][A-Za-z0-9_]*. Store only the name, never a credential value.
+	// APIKeyEnv optionally names an environment lookup source for an API key.
+	// NewEngine trims it and requires the portable form [A-Za-z_][A-Za-z0-9_]*.
+	// A direct RunRequest.APIKey takes precedence. When no usable credential is
+	// available, the built-in client omits Authorization; injected clients own
+	// their own credential-resolution behavior. Store only the name, never a
+	// credential value.
 	APIKeyEnv string
 	// ExtraParams contains backend-wide request defaults. Values must be
 	// JSON-compatible, finite, acyclic, and keyed by non-empty strings. Keys