env: .env file for API keys (gitignored), loaded by scripts and resolve_provider; key removed from bashrc

scripts/run_demo.sh

@@ -5,5 +5,13 @@
 #        scripts/run_demo.sh --agent scripted
 #        scripts/run_demo.sh --agent llm --model gemma4:e2b
 set -euo pipefail
+
+# Load API keys from the project .env file (if present)
+if [ -f .env ]; then
+  set -a
+  # shellcheck disable=SC1091
+  . ./.env
+  set +a
+fi
 cd "$(dirname "$0")/.."
 exec testbed/.venv/bin/python -m testbed.demo "$@"