VaultApiKeyProvider

An ApiKeyProvider that reads the API key from HashiCorp Vault's key/value secrets engine over Vault's HTTP API (#2479), for a deployment that cannot run Vault Agent or a CSI driver to write the key to a file (apiKeyFile).

The key is read on the first current(), then reused for VaultSettings.refreshInterval, then read again, so a key rotated in Vault is sent from the first request after the interval. Concurrent callers share one read. A read that fails is a Left and is tried again on the next call; the last key is not served after its interval, since a rotated-out key may already be revoked.

for
 keys   <- VaultApiKeyProvider(VaultSettings(vaultAddress, Secret(vaultToken), "llm4s/openai", "apiKey"))
 config <- Llm4sConfig.provider("openai-main").map(_.withApiKeyProvider(keys))
 client <- LLMConnect.getClient(config)
yield client

Errors never hold the key or the Vault token: an AuthenticationError when Vault refuses the token (401, 403), a NotFoundError when there is no secret at the path, a ConfigurationError when the secret has no usable string field, a ServiceError for any other status, and the HTTP client's own error when Vault cannot be reached.

It depends on no Vault SDK: one GET with llm4s's own HTTP client. Close it to close the HTTP client it created; one passed to VaultApiKeyProvider(settings, httpClient) stays the caller's to close.