Prune obsolete config API keys (#739)

* feat(memory_recipes): introduce memory recipes module for source-type-specific ingestion

- Added a new `memory_recipes` module that includes functionality for handling various source types, such as email and chat, with dedicated recipes for ingestion.
- Implemented core types and the `Recipe` trait to facilitate the ingestion process, allowing for structured handling of raw content and metadata.
- Created specific recipes for email and chat, enhancing the ability to process and normalize content before storing it in memory.
- Updated the core controller registration to include new endpoints for memory recipes, enabling JSON-RPC interactions for ingesting content and listing available recipes.
- Enhanced task management by integrating task storage and query helpers, allowing for better tracking and management of action items extracted during ingestion.

These changes significantly improve the ingestion capabilities of the application, providing a robust framework for handling diverse content types.

* refactor: remove API key references from configuration and schema

- Eliminated the `api_key` field from various configuration schemas and related structures, including `Config`, `ModelSettingsPatch`, and `ComposioConfig`, to streamline the configuration process.
- Updated the handling of API keys in the application to rely solely on session JWTs, enhancing security and simplifying the authentication flow.
- Adjusted related documentation and comments to reflect the removal of the API key, ensuring clarity in the new authentication approach.
- Refactored multiple components and functions to remove dependencies on the API key, improving code maintainability and reducing complexity.

These changes significantly enhance the security posture of the application by removing reliance on static API keys and promoting the use of session-based authentication.

* chore: update .env.example and documentation for API key removal

- Removed references to `OPENHUMAN_API_KEY` from the `.env.example` file to reflect recent changes in the authentication approach.
- Updated documentation in `AGENTS.md` and `CLAUDE.md` to clarify that `OPENHUMAN_API_URL` now overrides `config.api_url`, ensuring consistency across configuration references.
- Bumped the version in `Cargo.lock` to 0.52.23 to align with the latest changes.

These updates enhance clarity in configuration management and documentation following the removal of static API keys.

* fix: address config pruning review comments

* feat(tests): add validation tests for SearchResponse deserialization

- Introduced new tests to ensure that the SearchResponse struct correctly rejects JSON inputs missing required fields: searchId, results, and costUsd.
- Updated DelegateTool instantiation to remove the unused fallback_credential parameter, simplifying the constructor and related tests.

These changes enhance the robustness of the SearchResponse handling and improve code clarity by removing unnecessary parameters.

* refactor: remove api_key params from provider factory signatures

The OpenHuman backend now only uses the app-session JWT for auth —
the api_key parameter was ignored (as _api_key) after the config
pruning. Drop it from the signatures entirely instead of leaving
dead None arguments at every call site.

Also removes the unused ChannelContext.api_key field.

* refactor: remove api_key/composio_key params from factory signatures

Every caller was passing None after the config pruning:

- create_embedding_provider / create_memory* — the api_key param
  was only threaded to the openai / custom embedding branches, but
  no caller has ever supplied a non-None value since the pruning.
  Embeddings use an empty key; the param is gone.

- all_tools / all_tools_with_runtime — both composio_key and
  composio_entity_id only fed the ComposioTool registration block,
  which was already dead after the JWT migration. Drop both args
  and the block; the modern path is all_composio_agent_tools via
  build_composio_client(config).

* style: apply cargo fmt

.env.example

@@ -52,8 +52,6 @@ OPENHUMAN_CORE_BIN=
 # ---------------------------------------------------------------------------
 # Config overrides (override config.toml values at runtime)
 # ---------------------------------------------------------------------------
-# [required] API key for the LLM provider
-OPENHUMAN_API_KEY=
 # [optional] Default model to use
 OPENHUMAN_MODEL=
 # [optional] Workspace directory (default: ~/.openhuman or ~/.openhuman-staging when OPENHUMAN_APP_ENV=staging)
@@ -76,27 +74,12 @@ OPENHUMAN_REASONING_ENABLED=
 # ---------------------------------------------------------------------------
 # Web search
 # ---------------------------------------------------------------------------
-# Web search is always enabled — no opt-in flag. Configure the
-# provider / API keys / budgets below.
-# [optional] Search provider name
-OPENHUMAN_WEB_SEARCH_PROVIDER=
-# [optional] Required if web search provider is Brave
-OPENHUMAN_BRAVE_API_KEY=
+# Web search is always enabled — no opt-in flag. Configure result budgets below.
 # [optional] Default: 5
 OPENHUMAN_WEB_SEARCH_MAX_RESULTS=5
 # [optional] Default: 10
 OPENHUMAN_WEB_SEARCH_TIMEOUT_SECS=10
 
-# ---------------------------------------------------------------------------
-# Storage
-# ---------------------------------------------------------------------------
-# [optional] Storage backend (default: SQLite)
-OPENHUMAN_STORAGE_PROVIDER=
-# [optional] Database connection URL
-OPENHUMAN_STORAGE_DB_URL=
-# [optional] Connection timeout in seconds
-OPENHUMAN_STORAGE_CONNECT_TIMEOUT_SECS=
-
 # ---------------------------------------------------------------------------
 # Proxy
 # ---------------------------------------------------------------------------