Bug: Ollama cloud discovery returns env var name instead of value as API key

Component: extensions/ollama/src/discovery-shared.ts

File: discovery-shared-CoB9v71T.js (bundled)

Function: resolveOllamaDiscoveryApiKey

Root cause (lines 14-23):

function resolveOllamaDiscoveryApiKey(params) {
    const envValue = normalizeOptionalString(params.env.OLLAMA_API_KEY);
    const envApiKey = envValue ? "OLLAMA_API_KEY" : void 0;          // (1)
    const resolvedApiKey = normalizeOptionalString(params.resolvedApiKey);
    const explicitApiKey = normalizeOptionalString(params.explicitApiKey);
    if (explicitApiKey) return explicitApiKey;                       // (2)
    if (params.hasDeclaredApiKey && resolvedApiKey) return resolvedApiKey;  // (3)
    if (!isLocalOllamaBaseUrl(params.baseUrl))
        return envApiKey ?? (resolvedApiKey !== "ollama-local"
            ? resolvedApiKey : void 0);                              // (4)
    ...
}

Three bugs chained:

1. Line (1): envApiKey is set to the literal string "OLLAMA_API_KEY" (the env var name) instead of envValue (the env var value).

2. Line (2): When the gateway config has apiKey: "OLLAMA_API_KEY" (the literal marker), explicitApiKey catches it and returns the marker string immediately. The actual resolved value in resolvedApiKey on line (3) is never reached.

3. Line (4): Even if the config's apiKey is removed, the function still returns the marker string envApiKey for cloud endpoints instead of resolvedApiKey or envValue.

Impact: The HTTP transport receives the literal string "OLLAMA_API_KEY" as the API key. isNonSecretApiKeyMarker("OLLAMA_API_KEY") returns true, so the Authorization: Bearer header is never set. All Ollama cloud model requests return 401.

Expected behavior:

• For cloud Ollama endpoints (non-local), resolveOllamaDiscoveryApiKey should return the actual env var value (envValue or resolvedApiKey), not the env var name.
• The priority should be: explicitApiKey (if not a marker) → resolvedApiKey (env var value) → envValue → marker/fallback.

Suggested fix:

if (explicitApiKey && !isNonSecretApiKeyMarker(explicitApiKey))
    return explicitApiKey;
if (resolvedApiKey) return resolvedApiKey;
if (!isLocalOllamaBaseUrl(params.baseUrl))
    return envValue ?? resolvedApiKey;

Or simpler: remove lines (1) and (4)'s dependency on envApiKey, and use resolvedApiKey (which is the env var value) when explicitApiKey is a known marker.