Merge remote-tracking branch 'upstream/main' into pr-70

# Conflicts:
#	src/config/index.ts
#	src/llm/index.ts
#	src/server.ts
#	src/setup.ts
#	src/types/index.ts

src/__tests__/api-key-env-static.test.ts

@@ -3,6 +3,7 @@ import { readFileSync } from 'fs';
 import { join } from 'path';
 
 const configSource = readFileSync(join(process.cwd(), 'src/config/index.ts'), 'utf8');
+const serverSource = readFileSync(join(process.cwd(), 'src/server.ts'), 'utf8');
 const setupScript = readFileSync(join(process.cwd(), 'scripts/setup-api.sh'), 'utf8');
 
 function sourceBlock(startMarker: string, endMarker: string): string {
@@ -33,6 +34,11 @@ describe('API key environment handling hardening', () => {
     expect(block).toContain("join(homedir(), '.t3mp3st', '.env')");
   });
 
+  it('the API server does not re-enable caller-cwd dotenv loading', () => {
+    expect(serverSource).not.toMatch(/from ['"]dotenv['"]/);
+    expect(serverSource).not.toMatch(/\bdotenv\.config\s*\(/);
+  });
+
   it('setup-api.sh writes the same T3MP3ST-owned env file that ConfigManager reads', () => {
     const block = configLoadEnvBlock();
 
@@ -52,7 +58,7 @@ describe('API key environment handling hardening', () => {
   it('exportConfig redacts every supported provider key slot', () => {
     const block = exportConfigBlock();
 
-    for (const provider of ['openrouter', 'venice', 'anthropic', 'openai', 'xai', 'gemini', 'deepseek']) {
+    for (const provider of ['openrouter', 'venice', 'anthropic', 'openai', 'xai', 'gemini', 'deepseek', 'litellm']) {
       expect(block).toContain(`${provider}: settings.apiKeys.${provider} ? '***REDACTED***' : undefined`);
     }
   });