fix: remove api_key from config.yaml, read from EMBED_API_KEY env var; unify config path constant

tests/test_config.py

@@ -1,4 +1,5 @@
 """配置加载模块测试."""
+import os
 import tempfile
 from pathlib import Path
 
@@ -80,3 +81,26 @@ server:
         cfg = load_config("/nonexistent/config.yaml")
         assert cfg.chroma.persist_dir == "./data"
         assert cfg.embed.mode == "local"
+
+
+class TestEmbedConfigEnvVar:
+    """api_key 从环境变量读取."""
+
+    def test_api_key_from_env(self, monkeypatch):
+        monkeypatch.setenv("EMBED_API_KEY", "sk-env-test")
+        import importlib
+        from src.core import config
+        importlib.reload(config)
+        cfg = config.EmbedConfig(mode="api")
+        assert cfg.api_key == "sk-env-test"
+        # 清理
+        importlib.reload(config)
+
+    def test_api_key_empty_when_not_set(self, monkeypatch):
+        monkeypatch.delenv("EMBED_API_KEY", raising=False)
+        import importlib
+        from src.core import config
+        importlib.reload(config)
+        cfg = config.EmbedConfig(mode="api")
+        assert cfg.api_key == ""
+        importlib.reload(config)