Resolves from ENV → .env → vault, with optional runtime validation probes. No deps beyond Python stdlib.

Example:

from api_pilot import resolve_key client = OpenAI(api_key=resolve_key("openai", validate=True))

CLI doctor command:

$ api-pilot-doctor .env file found OPENAI_API_KEY found in environment

Modes: • Default: ENV → .env → vault • Validation: optional runtime API probes • Strict: fails if .env used (CI safety)

MCP integration ready.

Feedback welcome!