Yonde v0.3.3
Security and configuration isolation fix. Yonde no longer reads DEEPSEEK_API_KEY, DEEPSEEK_BASE_URL, DEEPSEEK_MODEL, JPNS variables, or any undeclared Key variable. API Key resolution is now translation.api.api_key first, then only the exact variable named by translation.api.api_key_env (default YONDE_API_KEY). Includes regression tests.