fix: pos ai — honor legacy AI_API_KEY as fallback (provider key stays primary)

Architect decision C on the API-key contract mismatch: docs claimed
AI_API_KEY was the required primary key, but resolve_key() only read
provider-specific keys (7ae2e77 removed shared-key priority to fix
cross-provider leakage; docs never updated).

- bin/pos-ai resolve_key(): provider key wins, legacy AI_API_KEY honored
  read-only when the provider's own key is empty, llamacpp unchanged;
  cmd_providers() configured check mirrors the same set
- require_key() error messages byte-stable (test-locked)
- AI_API_KEY NOT re-added to the # POS_CONFIG:/# PROVIDER_CONFIG: registry
- Docs reworded: POS.md rows 91/96/98 + precedence sentence, howto/ai.md
  first-run hints, HOWTO.md row, AGENT_Context prose (2 spots), config/ai.env
  legacy comment
- New regression tests/t-ai-key-resolution.sh: 24 checks / 10 cases
  (provider-key-only, AI_API_KEY-only, both -> provider wins, env-wins,
  llamacpp no-key, missing-key message, providers configured status)

Verified: suite 19 files / 440 checks / 0 fail / 0 skip; make gen
byte-idempotent; make check OK; make lint 0 FAIL, 0 WARN; bash -n clean;
git diff --check clean; Reviewer APPROVE_WITH_NOTES (mutation disproof:
inverted precedence -> C3/C6 fail)

config/ai.env

@@ -8,6 +8,7 @@
 # API keys (each provider needs its own):
 #   AI_GEMINI_API_KEY=<key>       # Gemini API key from aistudio.google.com
 #   OPENROUTER_API_KEY=<key>      # OpenRouter API key from openrouter.ai
+# Legacy fallback: AI_API_KEY=<key> is honored when the provider's own key is unset
 #
 # Model overrides (optional, defaults per provider):
 #   AI_GEMINI_MODEL=<model>       # Gemini model id (default: gemini-2.5-flash)