/// Store an API key in the OS keychain.
///
/// Stub implementation using environment variables until the `keyring` crate is
/// added. Keys are only held in-process and lost on exit.
///
/// # Safety note
/// `std::env::set_var` is deprecated in Rust 2024 edition and is **not**
/// thread-safe — mutating the environment while other threads read it is
/// undefined behaviour. This is acceptable during single-threaded app init
/// but must not be called from async/multi-threaded contexts.
///
/// TODO: Replace with the `keyring` crate (or platform-native credential
/// storage) so keys persist across sessions and are accessed safely.
#[allow(deprecated)] // set_var deprecated in Rust 2024 edition
pub fn store_api_key(provider: &str, key: &str) {
    // SAFETY: Only safe when called from a single-threaded context (e.g. app
    // initialisation). See doc comment above.
    std::env::set_var(format!("KON_API_KEY_{}", provider.to_uppercase()), key);
}

/// Retrieve an API key from the OS keychain.
///
/// Stub implementation using environment variables until the `keyring` crate is
/// added. Returns `None` if no key has been stored this session.
///
/// TODO: Replace with the `keyring` crate alongside `store_api_key`.
pub fn retrieve_api_key(provider: &str) -> Option<String> {
    std::env::var(format!("KON_API_KEY_{}", provider.to_uppercase())).ok()
}