fix(selfhost): keep advisory AI key explicit

[JSONbored]

Motivation

• Prevent accidental disclosure of the main OpenAI API key by stopping the AI_ADVISORY provider from falling back to OPENAI_API_KEY when AI_ADVISORY_API_KEY is unset.

Description

• Stop sending the main OpenAI credential to advisory endpoints by changing the advisory provider construction in src/server.ts to use apiKey: process.env.AI_ADVISORY_API_KEY instead of AI_ADVISORY_API_KEY ?? OPENAI_API_KEY.
• Add a regression unit test in test/unit/selfhost-ai.test.ts that asserts an OpenAI-compatible provider omits Authorization when no apiKey is given and sends its own bearer token when configured.
• Preserve the existing fail-safe behavior that an unset advisory binding leaves advisory call sites routing to the shared env.AI (no other runtime behavior was changed).

Testing

• Ran the new focused unit test via npx vitest run test/unit/selfhost-ai.test.ts -t "OpenAI-compatible provider has its own apiKey" and it passed.
• Ran npm run selfhost:env-reference:check and npm run typecheck and both checks succeeded.
• Ran the broader test/unit/selfhost-ai.test.ts suite and the file completed successfully (all targeted tests passed).

---

Codex Task

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 93.96%. Comparing base (ca5576f) to head (91b9f7f).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #4397   +/-   ##
=======================================
  Coverage   93.96%   93.96%           
=======================================
  Files         401      401           
  Lines       36869    36869           
  Branches    13480    13480           
=======================================
  Hits        34644    34644           
  Misses       1569     1569           
  Partials      656      656           

🚀 New features to boost your workflow:

• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.