feat(config): load one validated secret bundle

backend/src/pi/pi-process-manager.ts

@@ -4,6 +4,7 @@ import { RpcClient } from "../rpc/rpc-client.js";
 import { SessionBridge } from "../bridge/session-bridge.js";
 import type { ThtRunner } from "../tht/tht-runner.js";
 import { buildPiChildEnv, canonicalPiProvider } from "./provider-credentials.js";
+import { secretValue } from "../config/secret-bundle.js";
 
 export interface SessionRuntime {
   rpc: RpcClient;
@@ -39,6 +40,7 @@ export class PiProcessManager {
   ): ChildProcessWithoutNullStreams {
     const env = buildPiChildEnv({
       provider,
+      credentialValue: secretValue(this.cfg, "THT_MODEL_API_KEY"),
       credentialFile: this.cfg.modelApiKeyFile,
       additions: { THT_SESSION: sessionId, THT_AUTHOR: author },
     });