fix: never send an API key to the provider it wasn't entered for (v1.0.2)

A stored key carried no record of which provider it belonged to. Options
saves {provider, model} without the key whenever the field is blank (which
it always is after a save, since it shows the encrypted badge instead), so
switching provider left the previous provider's key attached to the new one.
Every call then failed with that provider's own "Invalid API Key" while the
UI still showed a key as configured.

- types.ts: new `keyProvider` storage field, added to CONFIG_STORAGE_KEYS
- background.ts: keyProviderMismatch() guards the chat, COPY_AS and
  stored-key LIST_MODELS paths; absent keyProvider (pre-upgrade) is allowed
- Options.tsx: stamps keyProvider on every save; drops the encrypted badge
  and requires a new key when the saved one belongs to another provider or
  is rejected; save-time guard messages are now actually rendered (they were
  gated on modelsStatus === 'error' and never drew, so Save looked dead)
- providers.ts: providerLabel(); settings hint appended to 401/403 only;
  listModels reports keyRejected and labels errors with the display name
- Anthropic: send anthropic-dangerous-direct-browser-access on the chat path

Docs: CLAUDE.md version-bump rule corrected — wxt.config.ts reads
pkg.version, so package.json is the only place to edit.

typecheck clean, 58/58 tests, build clean (281.72 kB, manifest 1.0.2).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

CLAUDE.md

@@ -133,7 +133,7 @@ Workflows live in `.gitea/workflows/`:
 - `deploy-chrome.yml` — on `v*.*.*` tag: build → upload → publish to Chrome Web Store.
 - Both send Telegram notifications. Secrets: `GITEATOKEN`, `CWS_*`, `TELEGRAM_*`.
 
-**Version bumps:** update `version` in **both** `package.json` and `wxt.config.ts` (the manifest version comes from wxt.config.ts). A `v*.*.*` git tag triggers the store deploy. (Single-sourcing tracked in T-16.)
+**Version bumps:** edit `version` in `package.json` only — `wxt.config.ts` reads `pkg.version`, so the manifest follows automatically (T-16 done). Use `npm version <x.y.z> --no-git-tag-version` so `package-lock.json` stays in sync. A `v*.*.*` git tag triggers the store deploy **and publishes it live** (`deploy-chrome.yml:91`).
 
 ## Orchestration & agents
 
@@ -166,7 +166,7 @@ Codebase invariants that break silently when violated (detail + evidence in `doc
 - Never log or transmit the API key except to the user's provider; keep the plaintext `apiKey` fallback until a migration exists.
 - Update both `callX` and `callXWithPrompt` when changing a provider's request shape.
 - Never `fetch` a provider from content/popup — route through the background worker.
-- Bump `version` in both `package.json` and `wxt.config.ts`.
+- Bump `version` in `package.json` only (+ lockfile); the manifest derives it via `pkg.version`.
 - Style inline; Tailwind classes do nothing until PostCSS is wired.
 
 ## Memory protocol