fix(backend): inject provider credentials from file

backend/test/routes-sessions.test.ts

@@ -1,6 +1,8 @@
 import { test, expect } from "vitest";
 import { spawn as nodeSpawn } from "node:child_process";
 import path from "node:path";
+import os from "node:os";
+import { chmodSync, unlinkSync, writeFileSync } from "node:fs";
 import { buildApp } from "../src/app.js";
 import { loadConfig } from "../src/config.js";
 
@@ -16,9 +18,14 @@ function mutApp(thtRunner: any) {
 }
 
 test("POST /sessions usa i settings (workspace/provider/model/thinking) e crea+avvia", async () => {
+  const modelKey = path.join(os.tmpdir(), `thoth-model-key-${process.pid}`);
+  writeFileSync(modelKey, "test-model-key", { mode: 0o600 });
+  chmodSync(modelKey, 0o600);
   let sessionNewArg: any;
   let spawnArg: any;
-  const app = buildApp(loadConfig({ THT_HARNESS_DIR: "../harness" }), {
+  const app = buildApp(loadConfig({
+    THT_HARNESS_DIR: "../harness", THT_MODEL_API_KEY_FILE: modelKey,
+  }), {
     thtRunner: {
       ollamaEnsure: async () => ({ ok: true }),
       sessionNew: async (o: any) => { sessionNewArg = o; return { id: "s1" }; },
@@ -36,6 +43,7 @@ test("POST /sessions usa i settings (workspace/provider/model/thinking) e crea+a
   expect(sessionNewArg.question).toBe("q");
   const list = await app.inject({ method: "GET", url: "/sessions" });
   expect(list.json()).toEqual([{ id: "s1" }]);
+  unlinkSync(modelKey);
 });
 
 test("POST /sessions/:id/response inoltra al bridge (no error)", async () => {