PR Vision v0.2.3: UI-editable provider API key, encrypted + write-only

Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL),
PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax.

Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc
option > none. All probe + test paths read key through PRV_Key_Store::get_key().

Security:
- Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext).
- Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored.
- Plaintext never in options, logs, exceptions, page source, REST, or JS.
- manage_options + nonce on set/remove/test. wp-config precedence enforced.
- write-only UI: password input always renders empty; status text only.
- uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc.

Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php
(encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence,
write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/
CHANGELOG all updated in this commit.

Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui

CONVENTIONS.md

@@ -82,3 +82,13 @@ Every public method must have:
 2. Implement `PRV_Dashboard_Panel` in `includes/panel/`.
 3. Register both in `PRV_Plugin::init()` via `PRV_Collector_Registry::instance()`.
 4. Update `ARCHITECTURE.md` §6 (Collector/Panel seam).
+
+## 9. API key access (v0.2.3)
+
+**Never read `PRV_OPENROUTER_API_KEY` directly in provider or handler code.**
+All key reads must go through `PRV_Key_Store::get_key()`. This maintains the precedence chain (constant → encrypted option → none) and ensures a key set via the admin UI is used without code changes.
+
+- Providers: call `PRV_Key_Store::get_key()` in `probe()`.
+- AJAX handlers: call `PRV_Key_Store::get_key()` before any LLM call.
+- New provider that needs the key: implement `is_configured()` as `'' !== PRV_Key_Store::get_key()`.
+- Do NOT pass the resolved key to any client-side surface, log, exception message, or `error_log()`.