OK: apiKeyEnvFile gates llama-swap auth (apiKeys + EnvironmentFile)