feat(prometheus): real providers (Gemini/fal/Pollinations…) + secure key store

- Secure secrets: gitignored ~/pyre/.env (chmod 600) loaded into the API via
  `node --env-file-if-exists`; keys never committed/logged/returned. .env.example
  documents the vars. Free-first default (text=gemini, image=pollinations).
- @pyre/config: provider selection + key fields.
- @pyre/prometheus: real providers via fetch (no SDK deps) — Gemini/Anthropic/
  OpenAI text, Pollinations(free)/fal/DeepInfra/Replicate image, OpenAI moderation;
  `createProviders()` factory selects by config + key presence, falls back to stub.
  29 tests.
- @pyre/api: /api/prometheus/generate builds providers from config; keys never logged.

Live-verified end-to-end: admin-gated generate returned a real Spawn ("Ashen
Golem"/$AGOL) with a Pollinations image on the $0 stub-text+free-image stack;
.env-loaded admin token enforced. typecheck 8/8, 150 tests.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

packages/config/src/index.ts

@@ -95,6 +95,20 @@ export interface AppConfig {
   swapFeeBps: number;
   /** Upper bound on a user's optional extra "feed the PYRE" contribution (bps). */
   maxContributionBps: number;
+
+  // ---- Prometheus AI providers (keys live only in the gitignored .env) ----
+  /** Text provider: "gemini" | "anthropic" | "openai" | "stub". */
+  prometheusTextProvider: string;
+  /** Image provider: "pollinations" | "fal" | "deepinfra" | "replicate" | "stub". */
+  prometheusImageProvider: string;
+  geminiApiKey: string;
+  anthropicApiKey: string;
+  openaiApiKey: string;
+  falKey: string;
+  deepinfraApiKey: string;
+  replicateApiToken: string;
+  /** Pinata JWT for IPFS upload of Spawn image + metadata. */
+  pinataJwt: string;
 }
 
 /** A minimal env-shaped record. `process.env` satisfies this. */
@@ -162,5 +176,14 @@ export function loadConfig(env: EnvSource = process.env): AppConfig {
     feeBps: parseIntSafe(env.PYRE_FEE_BPS, 500),
     swapFeeBps: parseIntSafe(env.PYRE_SWAP_FEE_BPS, 100),
     maxContributionBps: parseIntSafe(env.PYRE_MAX_CONTRIBUTION_BPS, 5000),
+    prometheusTextProvider: str(env.PROMETHEUS_TEXT_PROVIDER, "stub"),
+    prometheusImageProvider: str(env.PROMETHEUS_IMAGE_PROVIDER, "stub"),
+    geminiApiKey: str(env.GEMINI_API_KEY, ""),
+    anthropicApiKey: str(env.ANTHROPIC_API_KEY, ""),
+    openaiApiKey: str(env.OPENAI_API_KEY, ""),
+    falKey: str(env.FAL_KEY, ""),
+    deepinfraApiKey: str(env.DEEPINFRA_API_KEY, ""),
+    replicateApiToken: str(env.REPLICATE_API_TOKEN, ""),
+    pinataJwt: str(env.PINATA_JWT, ""),
   };
 }