API key selection now matches AI provider

Anthropic users running the CLI were forced to store their key in OPENAI_API_KEY — a misnamed variable that created confusion about which provider was actually configured. The CLI now matches the key name to the provider: set AI_PROTOCOL=anthropic and the CLI looks for ANTHROPIC_API_KEY instead. OpenAI and OpenAI-compatible providers (MiniMax, OpenRouter, etc.) continue using OPENAI_API_KEY. This mirrors the existing image-side pattern where GEMINI_API_KEY matches the gemini provider.

The change also tightens validation: wrong case values like "Anthropic" and trailing whitespace like "anthropic " now throw clear errors rather than silently falling back to the openai branch. Users switching providers will get immediate feedback if their environment variables are misconfigured.

In the cli/src/config.ts package, key lookup was extracted into a dedicated resolveTextApiKey function called by loadConfig. A new validateProtocol function enforces allowed values. Tests in config.test.ts cover eight scenarios including the two footguns the validation now catches.