Store the embeddings API key in the OS keychain, not in a plain YAML file #2380

Summary

The OpenAI embeddings API key is stored in a plain YAML config file. File permissions are only tightened when the file is found world-readable.

Why it matters

Other credentials already use the OS keychain (with a 0600 file fallback). A plain-text API key in a config file is easy to leak through backups, sync tools, or support bundles.

Proposal

• Store the embeddings API key in the OS keychain, like other credentials.
• If a file fallback is needed, always create it with 0600 permissions (not only fix them later).
• Migrate existing keys from YAML to the keychain and remove them from the file.
• Support reading the key from an environment variable for managed setups.

Acceptance criteria

• New installs never write the key in plain text to the YAML config.
• Existing keys are migrated on upgrade.
• The fallback file is always created with mode 0600.