fix(server): clear stale provider api keys

[imwyvern]

Linked Issue

Closes #4984

Description

Changing the configured provider could leave the previous provider's API key in the runtime config. Persisted overrides are now scrubbed when they switch providers, matching environment variables are applied after database overrides, and the dashboard clears the provider key field when the provider changes.

Added regression coverage for stale database overrides, runtime updates with env keys, dropping the previous provider key, and keeping a newly-entered provider key.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactor (no functional changes)
• Documentation update

Breaking Changes

N/A

Test Coverage

• I added/updated unit tests
• I added/updated integration tests
• I tested manually (describe below)
• No tests needed (explain why)

python3 -m pytest tests/test_server_state.py -q passes locally.

pnpm --dir server/dashboard run typecheck currently fails before checking this change because the local install is missing the implicit yauzl type definition.

Checklist

• My code follows the project's style guidelines
• I have performed a self-review of my code
• I have added tests that prove my fix/feature works
• New and existing tests pass locally
• I have updated documentation if needed

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[imwyvern]

I'll get the CLA signed — will follow up once it's done.