feat: support env-var source for embedding provider api_key

[ericfitz]

Summary

Follow-up from the review discussion on #78: the embedding provider api_key currently lives in plaintext in config.json, mitigated only by the documented chmod 600 guidance. Support supplying the key via an environment variable so it never needs to be written to disk.

Acceptance Criteria

• The embedder config accepts an environment variable as the API key source (e.g. an api_key_env field naming the variable, or a documented well-known variable that overrides api_key)
• Environment variable takes precedence over (or replaces the need for) the plaintext api_key value in config.json
• Clear error at startup/sync time when the named variable is unset and no fallback key is configured
• VECTOR_SEARCH.md provider setup docs updated to recommend the env-var path
• Existing plaintext api_key configs keep working unchanged

Notes

Suggested by @ergut in the PR #78 review: "plaintext api_key in config.json is fine for now given the chmod guidance, though env-var support would make a nice follow-up."