Add TOTP-gated provider API key reveal

Allow super administrators to inspect effective provider credentials only after audited, rate-limited step-up verification.

docs/openapi.yaml

@@ -978,6 +978,62 @@ paths:
         "400": { description: API key is blank, multiline, oversized, or malformed }
         "403": { description: SUPER_ADMIN role and valid CSRF are required }
         "404": { description: Provider is not supported }
+  /v1/admin/providers/{providerId}/api-key/reveal:
+    post:
+      security:
+        - adminMtls: []
+          adminSession: []
+      summary: Reveal the effective provider API key after a TOTP step-up
+      description: |
+        Returns the runtime override or environment-backed API key for the current
+        SUPER_ADMIN request only. Every attempt is rate-limited and audited without
+        recording the TOTP code or API key. Successful responses are non-cacheable.
+      parameters:
+        - name: providerId
+          in: path
+          required: true
+          schema: { type: string, enum: [deepseek, volcengine] }
+        - $ref: "#/components/parameters/AdminCsrf"
+        - name: X-Request-ID
+          in: header
+          required: false
+          schema: { type: string, pattern: "^[A-Za-z0-9_-]{8,64}$" }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              additionalProperties: false
+              required: [totpCode]
+              properties:
+                totpCode:
+                  type: string
+                  pattern: "^[0-9]{6}$"
+                  writeOnly: true
+      responses:
+        "200":
+          description: Effective API key revealed for this response only
+          headers:
+            Cache-Control:
+              schema: { type: string, const: no-store }
+          content:
+            application/json:
+              schema:
+                type: object
+                additionalProperties: false
+                required: [apiKey]
+                properties:
+                  apiKey:
+                    type: string
+                    minLength: 1
+                    maxLength: 4096
+                    format: password
+                    readOnly: true
+        "401": { description: TOTP verification failed or session is invalid }
+        "403": { description: SUPER_ADMIN role and valid CSRF are required }
+        "404": { description: Provider or a revealable API key was not found }
+        "429": { description: Step-up attempts are rate-limited }
   /v1/admin/overview:
     get:
       security:
@@ -1358,6 +1414,7 @@ paths:
               - CONTENT_HINT_FEED_SETTINGS_UPDATED
               - CONTENT_HINT_FEED_GENERATED
               - PROVIDER_API_KEY_UPDATED
+              - PROVIDER_API_KEY_REVEALED
         - name: result
           in: query
           schema: { type: string, enum: [success, rejected] }