DeepSeek API key

Phase-one provider key boundary and local-storage policy.

User-managed key

Gain Cloud accepts a DeepSeek key only on provider proxy requests, using the x-deepseek-api-key header. The cloud API does not persist the key, does not log request bodies, and does not expose prompt or response inspection in WebUI.

The desktop app can keep the key in local secure storage and send it per runtime call. A later credential lease flow is reserved but currently returns a user-managed stub.