Add request API key support

docs/internal/adapters.md

@@ -37,6 +37,7 @@ Public library facade:
 - Input: typed `scriptorium.RunRequest` values.
 - Output: typed `PreparedRun` and `RunResult` values plus public sentinel errors.
 - Custom LLM behavior is injected with `WithLLMClient`; otherwise the default OpenAI-compatible client is used.
+- `RunRequest.APIKey` is a request-scoped Go value only; it is converted into internal execution state for LLM generation and stripped from public result types.
 - Public types are facade types converted at the package boundary; internal domain types remain internal.
 
 Filesystem repositories:
@@ -60,6 +61,7 @@ LLM adapter:
 
 - Input: `domain.GenerateRequest`.
 - Output: `domain.GenerateResponse`.
+- Direct API-key values are preferred when present; otherwise `api_key_env` is resolved from the process environment.
 
 Validator:
 
@@ -123,6 +125,7 @@ LLM adapter:
 - compatible cache usage response fields are parsed into domain token usage.
 - non-2xx responses map to request failure errors.
 - malformed responses (including missing/empty first choice content) are errors.
+- direct API-key values are never serialized in provider request bodies.
 
 Validator: