PR Vision v0.2.3: UI-editable provider API key, encrypted + write-only

Add PRV_Key_Store (resolver), PRV_Crypto_Helper (libsodium/OpenSSL),
PRV_Key_Manager_Renderer (write-only Settings card), PRV_Key_Test_Ajax.

Key resolver: PRV_OPENROUTER_API_KEY constant > prv_provider_key_enc
option > none. All probe + test paths read key through PRV_Key_Store::get_key().

Security:
- Ciphertext only in prv_provider_key_enc (hex nonce:hex ciphertext).
- Enc key from SHA-256(AUTH_KEY+SECURE_AUTH_KEY) — never stored.
- Plaintext never in options, logs, exceptions, page source, REST, or JS.
- manage_options + nonce on set/remove/test. wp-config precedence enforced.
- write-only UI: password input always renders empty; status text only.
- uninstall.php prv_ wildcard DELETE covers prv_provider_key_enc.

Files: 4 new (all ≤300 lines), 14 modified. Tests: test-key-store.php
(encrypt/decrypt round-trip, wrong-key fails silently, resolver precedence,
write-only render, Remove, constant wins). ARCHITECTURE/CONVENTIONS/CONTEXT/
CHANGELOG all updated in this commit.

Agent-Session: 2026-06-15-pr-vision-v0.2.3-api-key-ui

includes/core/class-prv-key-test-ajax.php

@@ -0,0 +1,94 @@
+<?php
+/**
+ * AJAX handler: Test the resolved API key validity.
+ *
+ * @package PrVision
+ */
+
+declare(strict_types=1);
+
+/**
+ * AJAX handler for the "Test key" button in the Provider API Key section.
+ *
+ * Resolves the API key via PRV_Key_Store::get_key() and performs a single
+ * cheap probe. Reports valid/invalid without revealing the key value.
+ * Rate-limited to one test per 30 seconds.
+ *
+ * Who triggers: wp_ajax_prv_test_key (registered by PRV_Settings_Page).
+ * Dependencies: PRV_Key_Store, PRV_OpenRouter_Provider, PRV_Gateway_Client.
+ *
+ * @see class-prv-key-store.php      -- Key resolution.
+ * @see class-prv-settings-page.php  -- Registers the wp_ajax_ hook.
+ * @see class-prv-settings-renderer.php -- Renders the "Test key" button.
+ * @package PrVision
+ */
+class PRV_Key_Test_Ajax {
+
+	/**
+	 * Rate-limit window in seconds.
+	 */
+	const RATE_LIMIT_SECONDS = 30;
+
+	/**
+	 * Transient key for the rate-limit lock.
+	 */
+	const RATE_LIMIT_TRANSIENT = 'prv_key_test_lock';
+
+	/**
+	 * Cheap probe query — one call, minimal tokens.
+	 */
+	private const PROBE_QUERY = 'what is BPC-157';
+
+	/**
+	 * Handle the prv_test_key AJAX request.
+	 *
+	 * Verifies manage_options + nonce, rate-limits, resolves the key, probes,
+	 * and returns JSON success/error without ever including the key value.
+	 *
+	 * Side effects: HTTP call to LLM provider; sets a rate-limit transient; exits.
+	 *
+	 * @return void
+	 */
+	public function handle(): void {
+		if ( ! current_user_can( 'manage_options' ) ) {
+			wp_send_json_error( array( 'message' => 'Insufficient permissions.' ) );
+		}
+
+		$nonce = isset( $_POST['prv_nonce'] ) ? sanitize_text_field( wp_unslash( (string) $_POST['prv_nonce'] ) ) : '';
+		if ( ! wp_verify_nonce( $nonce, PRV_Settings_Page::NONCE_KEY_TEST ) ) {
+			wp_send_json_error( array( 'message' => 'Security check failed.' ) );
+		}
+
+		if ( false !== get_transient( self::RATE_LIMIT_TRANSIENT ) ) {
+			wp_send_json_error( array( 'message' => 'Rate limited — wait 30 s between tests.' ) );
+		}
+		set_transient( self::RATE_LIMIT_TRANSIENT, 1, self::RATE_LIMIT_SECONDS );
+
+		$api_key = PRV_Key_Store::get_key();
+		if ( '' === $api_key ) {
+			wp_send_json_error( array( 'message' => 'No API key configured.' ) );
+		}
+
+		$start    = microtime( true );
+		$provider = new PRV_OpenRouter_Provider( 'openai/gpt-4o-mini', null, null );
+
+		try {
+			$provider->probe_with_key( self::PROBE_QUERY, $api_key );
+			$ms = (int) round( ( microtime( true ) - $start ) * 1000 );
+			wp_send_json_success(
+				array(
+					'valid'      => true,
+					'latency_ms' => $ms,
+					'message'    => sprintf( 'Key valid · %d ms', $ms ),
+				)
+			);
+		} catch ( \Exception $e ) {
+			wp_send_json_error(
+				array(
+					'valid'   => false,
+					'message' => 'Key invalid or provider error — check key and try again.',
+				)
+			);
+		}
+	}
+}