GROQ_API_KEY / OPENAI_API_KEY are now the sole source for cloud
credentials. Matches bard's convention and keeps secrets out of
shell history and process listings.