fix: ai — per-provider API keys (remove shared AI_API_KEY)

Each provider now has its own key: AI_GEMINI_API_KEY and OPENROUTER_API_KEY.
No more shared AI_API_KEY that caused cross-provider key leakage (gemini
getting openrouter key → 400 error). resolve_key() sets AI_API_KEY internally
from the active provider's key for adapter use. Config UI shows both keys.

config/ai.env

@@ -2,14 +2,17 @@
 # Copied to ~/.config/linux_post_install/ai.env on install (no clobber).
 # Edit with: pos config ai
 #
-# Syntax:
+# Provider selection:
 #   AI_PROVIDER=gemini            # provider: gemini|openrouter (default gemini)
-#   AI_API_KEY=<key>              # API key for the active provider (secret)
-#   AI_MODEL=<model>              # model id (default depends on provider)
-#   AI_SYSTEM_PROMPT=<prompt>     # custom system prompt (overrides built-in; empty to reset)
 #
-# Legacy provider-specific keys (still supported as fallback):
-#   AI_GEMINI_API_KEY=<key>       # Gemini API key (used when AI_API_KEY is empty)
-#   AI_GEMINI_MODEL=<model>       # Gemini model id (used when AI_MODEL is empty)
-#   OPENROUTER_API_KEY=<key>      # OpenRouter API key (used when AI_API_KEY is empty)
-#   OPENROUTER_MODEL=<model>      # OpenRouter model id (used when AI_MODEL is empty)
+# API keys (each provider needs its own):
+#   AI_GEMINI_API_KEY=<key>       # Gemini API key from aistudio.google.com
+#   OPENROUTER_API_KEY=<key>      # OpenRouter API key from openrouter.ai
+#
+# Model overrides (optional, defaults per provider):
+#   AI_GEMINI_MODEL=<model>       # Gemini model id (default: gemini-2.5-flash)
+#   OPENROUTER_MODEL=<model>      # OpenRouter model id (default: openrouter/auto)
+#   AI_MODEL=<model>              # Override for all providers (takes priority)
+#
+# System prompt:
+#   AI_SYSTEM_PROMPT=<prompt>     # Custom system prompt (overrides built-in; empty to reset)