Reject API keys that are not valid header values at construction

FromSettings now fails with llm.ErrInvalidKey for a key with a control
character such as CR or LF, for every preset that sends a key, and
openai.New rejects such a key too, so neither defers the failure to the
first request. anthropic.New already rejected it. No error quotes the key.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ai/llm/settings.go

@@ -50,6 +50,9 @@ var (
 	// ErrUnexpectedKey means an API key was given to a preset that sends
 	// none.
 	ErrUnexpectedKey = errors.New("llm: provider takes no API key")
+	// ErrInvalidKey means the API key is not a valid HTTP header value:
+	// it has a control character such as CR or LF.
+	ErrInvalidKey = errors.New("llm: API key is not a valid header value")
 	// ErrMissingBaseURL means the preset requires a base URL and none was
 	// given.
 	ErrMissingBaseURL = errors.New("llm: base URL is required")