Reject API keys that are not valid header values at construction

FromSettings now fails with llm.ErrInvalidKey for a key with a control
character such as CR or LF, for every preset that sends a key, and
openai.New rejects such a key too, so neither defers the failure to the
first request. anthropic.New already rejected it. No error quotes the key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ai/llm/openai/openai.go

@@ -53,6 +53,7 @@ type Config struct {
 	BaseURL string
 	// APIKey is sent as "Authorization: Bearer <APIKey>". Empty sends no
 	// Authorization header, for endpoints such as Ollama that need none.
+	// It must not have a control character other than tab.
 	APIKey string
 	// Model is the model Generate requests. ListModels and Verify do not
 	// need it.
@@ -102,6 +103,9 @@ func newFromConfig(cfg Config) (*Provider, error) {
 	if u.User != nil || strings.ContainsAny(cfg.BaseURL, "?#") {
 		return nil, errors.New("openai: base URL must not carry credentials, a query or a fragment")
 	}
+	if !validHeaderValue(cfg.APIKey) {
+		return nil, errors.New("openai: API key has a control character")
+	}
 	// No error from New quotes caller-supplied text or a name derived from
 	// it: any such text may equal or contain the API key, and redaction
 	// cannot catch a fragment or a case-changed copy of it.