feat(models): add @extensible decorator to get_api_key()

Add @extensible decorator to get_api_key() in models.py, enabling
plugins to intercept or replace the API key resolution logic for
any LLM provider.

Currently, get_api_key() resolves API keys exclusively from OS
environment variables via os.getenv(). This means external secrets
backends (OpenBao/Vault, AWS Secrets Manager, Azure Key Vault, etc.)
cannot provide API keys without injecting them into the process
environment — a workaround that is fragile and bypasses the existing
SecretsManager architecture.

With @extensible, a plugin can intercept the start hook to resolve
API keys from any backend, falling through to the default dotenv
behaviour when no plugin is active.

To avoid a circular import (settings.py imports models at module
level, and models importing helpers.extension triggers the cycle
settings -> models -> extension -> subagents -> plugins -> extension),
the top-level `import models` in settings.py is moved inside the
three functions that actually use it. This is the standard Python
pattern for breaking import cycles.

No behavioural change for existing users — the decorator only adds
extension hooks around the existing function, and the deferred
import in settings.py has no performance impact since Python caches
module imports after the first load.

Author: Krashnicov

helpers/settings.py

@@ -6,7 +6,6 @@
 import subprocess
 from typing import Any, Literal, TypedDict, cast, TypeVar
 
-import models
 from helpers import runtime, whisper, defer, git, subagents
 from . import files, dotenv
 from helpers.print_style import PrintStyle
@@ -223,6 +222,7 @@ def _ensure_option_present(options: list[OptionT] | None, current_value: str | N
     return opts
 
 def convert_out(settings: Settings) -> SettingsOutput:
+    import models  # deferred to avoid circular import with models.py
     out = SettingsOutput(
         settings = settings.copy(),
         additional = SettingsOutputAdditional(
@@ -309,6 +309,7 @@ def convert_out(settings: Settings) -> SettingsOutput:
     return out
 
 def _get_api_key_field(settings: Settings, provider: str, title: str) -> SettingsField:
+    import models  # deferred to avoid circular import with models.py
     key = settings["api_keys"].get(provider, models.get_api_key(provider))
     # For API keys, use simple asterisk placeholder for existing keys
     return {
@@ -418,6 +419,7 @@ def _adjust_to_version(settings: Settings, default: Settings):
 
 
 def _load_sensitive_settings(settings: Settings):
+    import models  # deferred to avoid circular import with models.py
     # load api keys from .env
     providers = get_providers("chat") + get_providers("embedding")
     for provider in providers:

models.py

@@ -26,6 +26,7 @@
 from helpers.rate_limiter import RateLimiter
 from helpers.tokens import approximate_tokens
 from helpers import dirty_json, browser_use_monkeypatch
+from helpers.extension import extensible
 
 from langchain_core.language_models.chat_models import SimpleChatModel
 from langchain_core.outputs.chat_generation import ChatGenerationChunk
@@ -198,6 +199,7 @@ def output(self) -> ChatChunk:
 api_keys_round_robin: dict[str, int] = {}
 
 
+@extensible
 def get_api_key(service: str) -> str:
     # get api key for the service
     key = (