fix(backend): reject compound provider credentials

README.md

@@ -167,6 +167,17 @@ recognized child variable (for example `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `G
 `ZAI_API_KEY`). Neither the generic file path nor deprecated `PI_PROVIDER_API_KEY` is inherited by
 Pi. Local providers such as Ollama require no model key.
 
+`THT_MODEL_API_KEY_FILE` supports Pi providers whose authentication is exactly one key:
+`ant-ling`, `anthropic`, `cerebras`, `deepseek`, `fireworks`, `github-copilot`, `google`
+(including the `gemini` alias), `google-vertex` when using its API-key mode, `groq`,
+`huggingface`, `kimi-coding`, `minimax`, `minimax-cn`, `mistral`, `moonshotai`,
+`moonshotai-cn`, `nvidia`, `openai`, `opencode`, `opencode-go`, `openrouter`, `together`,
+`vercel-ai-gateway`, `xai`, the four `xiaomi*` providers, `zai`, and `zai-coding-cn`.
+Compound providers are deliberately unsupported: `amazon-bedrock`, `azure-openai-responses`,
+`cloudflare-workers-ai`, and `cloudflare-ai-gateway` require multiple credential/configuration
+values. Selecting one fails before Pi starts; ambient AWS, Azure, and Cloudflare credentials are
+still scrubbed. Supporting them requires a future dedicated provider-specific configuration.
+
 ## Reproducible image verification
 
 Base images use exact tags and immutable multi-platform manifest digests. Dependency update and