Auth configuration parsed from auth.* keys. Controls whether this client
resolves provider tokens from the local auth.json (default) or from a
remote credential broker. See task #157 / auth::credential_source.
Typed per-role turn-budget overrides (Task 23, spec §8.1). Every field
is optional: unset fields keep the role’s compiled default. Values are
parsed from turn_budget.<role>.<field> config keys.
Returns the configured identity string for the system prompt preamble.
Falls back to DEFAULT_IDENTITY (the SynapsCLI identity above) if not set
in config. Initialized by load_config() — safe to call anytime after boot.
Provider API keys parsed from provider.<name> = ... lines in config.
Empty if load_config() hasn’t been called. The registry falls back to
env vars, so e.g. GROQ_API_KEY works even with an empty map.
Sets the active profile name. Must be called before any get_profile() call
(i.e., before config resolution begins). Uses OnceLock — first write wins,
subsequent calls are no-ops. No env var mutation (unsafe under tokio).
Write a single key = value pair to ~/.synaps-cli/config (or profile config).
Replaces the first existing line that matches the key, or appends if absent.
Preserves comments and unknown keys. Writes atomically via temp file + rename.