fix: isolate LiteLLM embedding credential from ambient OpenAI key

[acidkill]

Summary

Allow the OpenAI-compatible smem embedder to use SURREAL_MEMORY_EMBEDDING_API_KEY independently of an unrelated ambient OPENAI_API_KEY (here used with Z.AI). The reranker already uses SURREAL_MEMORY_RERANKER_API_KEY; both dedicated variables can point to the same LiteLLM virtual key and endpoint.

Changes

• Credential precedence: explicit constructor key, dedicated embedding key, provider fallback key. OpenRouter retains OPENROUTER_API_KEY.
• Add provider/endpoint isolation regressions and document the dedicated key. No schema migration or model change.

Type of Change

• Bug fix
• Tests
• Documentation

Testing

• Focused provider pytest: 25 passed
• Ruff lint/format, mypy (361 source files), config reference freshness and diff check
• CI and independent agent review pending

Operational note

A production consolidate is active; this PR does not touch it or the cluster. Local environment.d now contains matching dedicated embedding/reranker LiteLLM keys while preserving the original ambient Z.AI key; a final post-upgrade smem recall is needed after the consolidation completes.