feat(prometheus): real providers (Gemini/fal/Pollinations…) + secure key store

- Secure secrets: gitignored ~/pyre/.env (chmod 600) loaded into the API via
  `node --env-file-if-exists`; keys never committed/logged/returned. .env.example
  documents the vars. Free-first default (text=gemini, image=pollinations).
- @pyre/config: provider selection + key fields.
- @pyre/prometheus: real providers via fetch (no SDK deps) — Gemini/Anthropic/
  OpenAI text, Pollinations(free)/fal/DeepInfra/Replicate image, OpenAI moderation;
  `createProviders()` factory selects by config + key presence, falls back to stub.
  29 tests.
- @pyre/api: /api/prometheus/generate builds providers from config; keys never logged.

Live-verified end-to-end: admin-gated generate returned a real Spawn ("Ashen
Golem"/$AGOL) with a Pollinations image on the $0 stub-text+free-image stack;
.env-loaded admin token enforced. typecheck 8/8, 150 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.env.example

@@ -22,10 +22,21 @@ REDIS_URL=redis://localhost:6379
 
 # ---- AI services (Prometheus) ----------------------------------------------
 # API-based only for MVP. Do NOT run local LLMs/image models on the server.
+# Keys live ONLY in the gitignored ~/pyre/.env (chmod 600), loaded by the API at
+# runtime — never in this committed template, never in git.
+#
+# Provider selection (free-first default): text=gemini (free tier), image=
+# pollinations (free, keyless). Falls back to a deterministic stub when a key is
+# missing, so generation always runs.
+PROMETHEUS_TEXT_PROVIDER=stub          # gemini | anthropic | openai | stub
+PROMETHEUS_IMAGE_PROVIDER=stub         # pollinations | fal | deepinfra | replicate | stub
+GEMINI_API_KEY=                        # free tier — aistudio.google.com/apikey
 ANTHROPIC_API_KEY=
-OPENAI_API_KEY=
-IMAGE_GEN_PROVIDER=                    # e.g. openai | stability | replicate
-IMAGE_GEN_API_KEY=
+OPENAI_API_KEY=                        # also enables the free omni-moderation pass
+FAL_KEY=                               # fal.ai (FLUX schnell ~$0.003/img)
+DEEPINFRA_API_KEY=                     # cheapest image (~$0.0005/img)
+REPLICATE_API_TOKEN=                   # FLUX schnell ~$0.003/img
+PINATA_JWT=                            # IPFS upload of Spawn image + metadata
 
 # ---- App URLs / ports ------------------------------------------------------
 WEB_PORT=3000