Provider API keys parsed from provider.<name> = ... lines in config.
Empty if load_config() hasn’t been called. The registry falls back to
env vars, so e.g. GROQ_API_KEY works even with an empty map.
Sets the active profile name. Must be called before any get_profile() call
(i.e., before config resolution begins). Uses OnceLock — first write wins,
subsequent calls are no-ops. No env var mutation (unsafe under tokio).
Write a single key = value pair to ~/.synaps-cli/config (or profile config).
Replaces the first existing line that matches the key, or appends if absent.
Preserves comments and unknown keys. Writes atomically via temp file + rename.