fix(offload): resolve local-LLM api key via OpenClaw auth-profiles

[YOMXXX]

Summary

Fixes #90 — when offload.model is set in provider/model form, the local-LLM backend only reads models.providers[providerKey].apiKey from the runtime config. OpenClaw's auth-profiles deliberately doesn't propagate the key into that map (the host injects it into the model call out-of-band instead), so users on auth-profiles see:

[context-offload] Local LLM mode failed: provider "deepseek" not found or missing baseUrl/apiKey in models.providers. L1/L1.5/L2 disabled.

…and the L1 / L1.5 / L2 layers stay disabled even though the model works fine for agent calls.

Change

src/offload/index.ts — resolve the key in two ordered steps:

1. api.resolveProviderAuth(providerKey) if exposed by the host (verified against the OpenClaw 2026.5.12 SDK — covers api-key profiles, env-var fallbacks, and the OAuth mode the host already uses for agent → model calls). Feature-detected via typeof === \"function\" so older hosts still load.
2. models.providers[providerKey].apiKey if step 1 returns nothing — keeps existing inline-config setups working unchanged.

baseUrl is still read exclusively from models.providers. resolveProviderAuth intentionally doesn't carry endpoint info (auth-profiles is for credentials, not routing).

Side-touches kept tight:

• The "missing config" error now spells out which field is missing and where to set it (auth-profile for \"<provider>\" vs models.providers[*].apiKey / .baseUrl), so triage doesn't need a second round-trip.
• Added a debug-level log line reporting the apiKey source (e.g. apiKey source=auth-profile:api_key) so --debug users can confirm which path fired.

What's intentionally NOT in this PR

• No new config schema — relying on the host's standard auth-profile resolution; no plugin-side config required.
• No change to extraction/persona pipelines. They go through the host's LLMRunner and don't hit this code path, so they were never broken in the same way. Filing as a follow-up if it turns out other modules duplicate the inline-only pattern.

Test plan

• npm run build (tsdown) clean — verified locally.
• On OpenClaw with offload.model: \"deepseek/deepseek-v4-flash\" and the deepseek key registered only as an auth-profile (no models.providers.deepseek.apiKey): offload pipeline starts, debug log shows apiKey source=auth-profile:*, L1/L1.5/L2 fire normally.
• Same config but with the key set inline in models.providers.deepseek.apiKey (no auth-profile): still works, debug log shows apiKey source=models.providers.
• No models.providers.deepseek.baseUrl set: error message now reads provider \"deepseek\" is missing baseUrl (set models.providers[\"deepseek\"].baseUrl).
• Older OpenClaw host without resolveProviderAuth: plugin still loads, falls through to the inline-config path, no exception.

[Maxwell-Code07]

Thank you for your interest in our project!

We noticed you've opened several PRs against our Good First Issues at once. These issues are specifically intended for first-time contributors to get familiar with the project in a low-pressure way.

To keep this spirit, we ask that contributors work on 1–2 issues at a time. We're keeping your PRs for #69 and #68 and will review them soon. The other PRs will be closed for now so others can pick them up.

After your current PRs are merged, feel free to claim more! Thanks for understanding and hope to see more of your contributions. 🙏