payments-stripe: read STRIPE_API_KEY from env, drop api_key from Input

[mike-hanono]

Summary

Stacks on #37. Removes the pub api_key: String field from all 6 Stripe endpoint Input structs and switches the tool to the env-var credential pattern already used by memory-memwal and storage-walrus.

Why this is critical: tool inputs flow through the Nexus DAG on Sui as plaintext. Any field on Input is effectively published on-chain. The current api_key field meant every Stripe DAG invocation was about to write the secret key (sk_test_… or sk_live_…) to a public ledger forever.

What changes

• src/stripe_client.rs — from_env() reads STRIPE_API_KEY once at startup; wraps in zeroize::Zeroizing<String> (heap-zeroed on drop); validates prefix (sk_test_ / sk_live_ / rk_test_ / rk_live_) and length. Hand-written Debug prints <redacted> — no #[derive(Debug)] on the credential-bearing type. Shared HTTP client lives in a OnceLock so the connection pool survives across calls. #[cfg(test)] for_testing(base_url, bearer) constructor bypasses env validation for mockito tests.

• src/main.rs — Explicit multi-thread tokio runtime; env_logger init before anything else; --meta short-circuit so CI's prepare step can pull /meta from an image with no env mounted; load_dotenv_if_present() and validate_credentials_at_startup() before bootstrap!. main is the only process::exit site. Exit 1 if STRIPE_API_KEY is unset, empty, or has an unrecognized prefix.

• All 6 endpoint files — Dropped pub api_key: String from Input. Dropped .with_auth(&input.api_key) from invoke(). NexusTool::new() calls StripeClient::from_env().unwrap_or_else(|e| { log::error!(...); panic!(...) }) — startup-only panic, mirrors memwal. idempotency_key stays on Input (per-call dedup data, not a credential — explicit whitelist in the auditor).

• Tests — Every StripeClient::new(Some(&server.url())) → StripeClient::for_testing(&server.url(), "sk_test_FAKE"). api_key: field dropped from every test_input() and inline Input literal. get-balance Input is now {} (no fields needed).

• Cargo.toml — Added workspace deps anyhow, dotenvy, env_logger, log, zeroize.

• README.md — Rewrote credential section to document the env var. Dropped api_key from every per-FQN Input table. Added an env-vars table. Threaded <TOOL_FQN_VERSION> into each FQN heading (matching what's actually in source via concat!(..., env!("TOOL_FQN_VERSION"))).

• .env.example — Documents STRIPE_API_KEY for local dev. In production Cloud Run mounts it via secretKeyRef from GCP Secret Manager, configured by the operator out-of-band — the deploy pipeline does NOT provision the upstream API key. tools.json's environment block is RUST_LOG only (C10 conformance).

• Skill markdown lints — 4 files in .claude/skills/nexus-tool-builder/reference/ had compact table separators (|---|) rewritten to | --- | to satisfy MD060 so this branch's pre-commit md-lint passes. These same files are rewritten by Add nexus-tool-builder skill + nexus-tool-auditor agent #31; the conflict at merge is a no-op since both branches use | --- |.

Out of scope

• AUDIT.md regeneration — deferred. Run the nexus-tool-auditor agent against the merged tree, or invoke it after this branch lands. The version currently in the crate is stale (it documents the pre-fix Input shape).

Test plan

• Reviewer reads the diff and confirms api_key no longer appears on any Input struct.
• CI runs cargo +stable check --package payments-stripe (blocked locally — sandbox missing pkg-config/libssl-dev for openssl-sys).
• CI runs cargo +stable clippy --package payments-stripe -- -D warnings.
• CI runs cargo +stable test --package payments-stripe (mockito tests with for_testing() constructor).
• Manual smoke against a real test key: STRIPE_API_KEY=sk_test_… cargo run --release --package payments-stripe then curl /create-payment-intent/health and curl /create-payment-intent/meta.
• Re-run the auditor agent against the merged crate and update AUDIT.md.

Verification done locally

• Ran the updated audit script (from Add nexus-tool-builder skill + nexus-tool-auditor agent #31's HEAD) against this crate in a sibling worktree rebased onto main:
  • PASS static:input-credential (C1 — the central check this PR fixes)
  • PASS static:debug-on-credentials (C8)
  • PASS static:stateful (C9)
  • PASS tools-json:shape / tools-json:secret-in-env (C10, H7)
  • PASS conform:output-enum / description / fqn-versioned
• npx markdownlint-cli2 '**/*.md' '!.git/' → 0 errors across 26 files.

🤖 Generated with Claude Code