fix(llmhubs): add credential placeholders to model config templates

[xinkuleee]

Summary

The llmhubs config templates under deploy/config/llmhubs/ were missing the
credential/auth field, so a user copying a template to activate a model had no
indication of how to supply an API key — inconsistent with the existing
OpenRouter template, which already included one.

This adds the correct, provider-specific credential placeholder (as an
environment-variable reference) to each provider example:

• Azure OpenAI / Azure AI Foundry → api_key: ${AZURE_OPENAI_API_KEY:-}
• OpenAI-compatible / OpenRouter → bearer_token: ${<PROVIDER>_API_KEY}
• Anthropic / Gemini → api_key_value: ${<PROVIDER>_API_KEY} (sent as x-api-key)
• The active gpt5.4-template.yaml config and the active config in
  model-template.yaml also get api_key: ${AZURE_OPENAI_API_KEY:-} plus a
  short auth comment.

All values are env-var references — no secrets are committed. Field names match
what each adapter reads (adapters/base.py._build_auth_headers; the Azure
adapter/embedding readers use config["api_key"]). The ${VAR:-} vs ${VAR}
choice is deliberate and matches config_loader semantics: an empty default
keeps the descriptor loadable (Azure falls back to managed identity when the key
is unset), while a bare ${VAR} correctly skips a provider's model when its
required key is unset.

Validation

• make precommit-run
• cd backend && go test ./...
• cd core && uv run pytest
• Frontend build/lint, if working from a frontend source checkout
• Not run; explain below

Backend/Core/Frontend suites are not applicable — this change only touches
template: true YAML data under deploy/config/llmhubs/; no Go, Python, or
frontend code changed. In addition to pre-commit, I verified the two files parse
as YAML and cross-checked every field name and the ${VAR:-} / ${VAR}
behavior against core/app/llmhubs/config_loader.py and
core/app/llmhubs/adapters/base.py.

Checklist

• Linked relevant issues or explained why there is no issue. (No tracked
  issue; addresses a code-review comment that the llmhubs templates were
  incomplete/missing the key field.)
• Updated docs and examples where behavior changed. (The templates are the
  docs; the existing deploy/config/llmhubs/README.md already documents
  ${VAR} / ${VAR:-default} substitution.)
• Updated CHANGELOG.md under ## [Unreleased] for user-facing changes.
  (N/A — config-template/docs completeness only; no user-facing runtime change.)
• Regenerated and committed generated files after proto, Wire, or OpenAPI
  changes. (N/A — none touched.)
• Confirmed no secrets, tokens, credentials, or sensitive logs are included.
  (Only env-var placeholders; verified git diff.)

Notes for reviewers

• Both files carry template: true, so the loader skips them at runtime — this
  is documentation/example completeness only, zero runtime behavior change.
• Deliberate ${VAR:-} (Azure) vs ${VAR} (others): Azure supports a
  managed-identity fallback, so an empty key should still load the model; the
  other providers require a key, so the model should be skipped when unset. This
  matches config_loader._expand_env_in_string (empty explicit default is not
  treated as "missing").