BYOK provider keys

Per-workspace Anthropic / OpenAI / Google keys, encryption, rotation, testing, and resolution order.