Snapshot per-provider credentials from the parent config for actor
provisioning. Serialized generically so this code does not chase the
per-provider config struct shapes — any slot with a non-empty api_key
yields a scoped credential (plus base_url when present).