Keep OpenAI-Compatible API Keys Out of Browser Code

A browser cannot keep a provider API key secret. If JavaScript can read the key, users, extensions, developer tools, and injected scripts can read it too. Obfuscation does not change that boundary. Ne