[code-review] A2A.Auth.APIKey (singular) not env-expanded — users get literal string instead of env var value

[topcheer]

File: internal/config/config.go
Lines: 1210-1215
Severity: Medium

Problem

expandEnvs() expands A2A.Auth.APIKeys (plural slice) and A2A.Host but skips A2A.Auth.APIKey (singular field). Users using ${ENV_VAR} in a2a.auth.api_key get the literal string instead of the env var value. A2A authentication fails silently.

Trigger Scenario

1. User sets a2a.auth.api_key: "${MY_KEY}" in config YAML
2. expandEnvs() runs: expands APIKeys[] (plural) and Host, but NOT APIKey (singular)
3. c.A2A.Auth.APIKey still contains literal "${MY_KEY}" — not expanded
4. A2A authentication sends literal ${MY_KEY} as the API key — fails silently

Expected vs Actual

• Expected: Both singular and plural API key fields are env-expanded
• Actual: Only the plural APIKeys is expanded; singular APIKey is silently skipped

Fix

Add before the APIKeys loop:

c.A2A.Auth.APIKey = ExpandEnvWithLookup(c.A2A.Auth.APIKey, lookup)

[topcheer]

Fixed in 6da4121. Added c.A2A.Auth.APIKey = ExpandEnvWithLookup(c.A2A.Auth.APIKey, lookup) before the APIKeys (plural) loop, so both singular and plural API key fields are environment-expanded.