fix(providers): log resolved .env source

[Teerapat-Vatpitak]

Summary

• Emit one behavior-preserving INFO line at .env resolution naming
  which candidate slot won, plus the resolved provider/model/base.
• The slot is a fixed symbolic label (~/.vibe-trading/.env,
  <AGENT_DIR>/.env, <CWD>/.env) — the absolute path, OS username,
  home and CWD are never logged (CWE-209); the API key is never logged.
• Observability-only: resolution order, first-match latch,
  override=False, and packaging anchor are unchanged.

Why

.env resolution was silent. With a first-match latch and
override=False, a stale or shadowed .env won the whole-process
config with no signal as to which file/precedence won — turning a
misconfig into hours of triage (P08, R1).

This is the protected-module change discussed and approved in #123
(@warren618, 2026-05-16: "no API key, redacted path — sounds right").
Deeper precedence/anchor/override changes (R3–R7) remain deferred to
separate issue-first discussion per the protected-module rule.

Closes #123

Changes

• agent/src/providers/llm.py: add _ENV_LABELS + _redact_env_source()
  (maps a resolved candidate to a leak-free symbolic label; unknown
  paths collapse to <.env>, missing to none (no .env file found)),
  and one logger.info(...) in _ensure_dotenv().
• agent/tests/test_dotenv_observability.py (new): 4 regression tests —
  redacted-label-not-path (CWE-209), helper mapping, none-case, and
  latch-preserved (no re-log on second call).

Test Plan

• Existing tests pass (pytest --ignore=agent/tests/e2e_backtest --tb=short -q) — 1162 passed, 1 skipped (pre-existing TUSHARE_TOKEN)
• New tests added — 4 in test_dotenv_observability.py
• Tested manually — runtime check confirms the emitted line is dotenv resolved from <AGENT_DIR>/.env | provider=… … with no absolute path / OS username / sk- present
• ruff check clean on changed files (lint is best-effort; CI does not enforce ruff)

Checklist

• Changes to protected src/providers/ were discussed and approved first (Discuss: .env resolution observability in providers/llm.py (protected module) #123)
• No hardcoded values (labels are fixed non-secret placeholders; no paths/keys logged)
• Code follows CONTRIBUTING.md guidelines
• Documentation updated — N/A (internal diagnostic log, no user-facing doc surface)