Support API key env for recall extraction endpoints

[binyangzhu000-sudo]

Summary

• add api_key_env to [recall.extract.servers.<name>] so authenticated OpenAI-compatible recall extraction endpoints can use bearer tokens without embedding credentials in URLs
• wire the resolved server key into the extraction client and keep endpoint-provided diagnostics withheld when a bearer credential is configured
• document an Atlas Cloud HTTPS example using ATLASCLOUD_API_KEY and deepseek-ai/deepseek-v4-pro

Testing

• git diff --check
• Atlas Cloud live model catalog: GET https://api.atlascloud.ai/v1/models returned HTTP 200 with 121 models; confirmed deepseek-ai/deepseek-v4-pro and qwen/qwen3.5-flash
• Not run: gofmt / go test ./internal/config ./internal/recall/extract ./cmd/agentsview because this machine has no Go toolchain in PATH (go and gofmt command not found); Docker is installed but the daemon is not running

[roborev-ci]

roborev: Combined Review (3905ea4)

The changes are clean with no Medium, High, or Critical findings.

---

Reviewers: 2 done | Synthesis: codex, 5s | Total: 3m23s

[roborev-ci]

roborev: Combined Review (fabbe5b)

No issues found.

---

Reviewers: 2 done | Synthesis: codex | Total: 2m19s

[wesm]

Makes sense