Snapshot per-provider credentials from the parent config for actor
provisioning. api_key (plaintext, in-memory only) is #[serde(skip_serializing)]
on every legacy single-instance provider struct — it’s hydrated from
api_key_encrypted at load time but deliberately never round-tripped
through serde, so a serde_json::to_value projection of config.providers
sees none of it (#495). Read each typed struct’s api_key field directly
instead, mirroring how provider_instances below already has to.