Key-presence refusal at every gate: a pinned model is not enough

Owner-diagnosed: the turn gate checked only model coordinates, so a
pinned slot whose provider key was deleted passed the gate and died
mid-stream masked to 'An error occurred.' The key is now gated where
the model is — by what would RUN (env-first keyValue truth, so an
env-shadowed key passes).

- core/settings.ts: the provider_key_missing envelope family (code,
  provider, slots, human line naming the provider from AUTH_PROVIDER_KEYS
  labels) + ProviderKeyMissingError + isProviderKeyRefusal matcher.
- chat-handler turn gate: refuses 503 before beginTurn when the resolved
  conversation's provider key is gone (slots: [strong]).
- Job runner: same check via an injected dep (agent layer cannot read
  the key store) — a keyless engine refuses the spawn through the
  existing failure-shape convention, no phantom run.
- Extraction pipeline: refuseIfStagesUnready refuses BEFORE any batch
  (first offender: extractor before auditor); the trigger skips info-
  level, /api/graph/import surfaces the 503 envelope per file.
- Tests: 8 new pins (turn gate both ways, runner refusal, pipeline
  first-offender + pass-through, envelope factory, matcher); the three
  turn-driving suites seed OPENROUTER_API_KEY like any real setup.
- Doc fix: stale EXTRACTION.chunkTokens comment in the manual-extract
  route (left over from eed4b4e).

Known residual (pre-existing, flagged for master): the manual extract
route logs BOTH config refusals as console.error (fire-and-forget path);
the coverage ledger keeps everything uncovered either way.

src/server/keys.ts

@@ -193,6 +193,17 @@ export function keyValue(id: string): string | undefined {
 	return process.env[id] ?? authStore.authVars()[id];
 }
 
+/** The key-presence truth for one model provider (provider-key interlude,
+ * 2026-09-25): would this provider's key be present at request time?
+ * Reads through keyValue — the SAME env-first lookup pi-ai performs
+ * natively at every request — so an env-shadowed key counts as present
+ * (gate by what would run). Providers absent from AUTH_PROVIDER_KEYS take
+ * no key at all: nothing to gate, present by definition. */
+export function providerKeyPresent(provider: string): boolean {
+	const info = AUTH_PROVIDER_KEYS.find((p) => p.id === provider);
+	return info ? keyValue(info.envVar) !== undefined : true;
+}
+
 /**
  * Save one key (PUT). Shape gate first (owner decision: bad pastes are
  * 400s, never stored), then the file write, then the env reflection. A