feat(extractor): optional bearer token for the HTTP extraction transport

[sedmondson]

Summary

Adds an optional bearer token to the OpenAI-compatible HTTP extraction transport (--extractor-http / LCG_EXTRACTION_URL), read from a new LCG_EXTRACTION_API_KEY env var and sent as Authorization: Bearer <key>.

This mirrors what the embedder already supports via LCG_EMBEDDING_API_KEY, and closes the gap for users who can only reach a frontier model through an authenticated OpenAI-compatible proxy (a corporate LLM gateway, a hosted provider, etc.) rather than a direct ANTHROPIC_API_KEY. Without this, --extractor-http could only target unauthenticated local servers.

Changes

• OaiExtractor gains an api_key: Option<String> field, populated from LCG_EXTRACTION_API_KEY in new_http / from_env. Always None for the UDS transport, matching the embedder's rule that a local socket never gets a credential.
• send_chat adds .bearer_auth(key) on the HTTP path when a key is present. No behavior change when unset.
• New with_api_key(Option<String>) builder for explicit control (and to keep tests independent of the ambient environment).
• Two unit tests via a header-capturing stub server: the header is sent when a key is set, and absent when not.
• docs/configuration.md: one row for LCG_EXTRACTION_API_KEY.

Verified

• cargo fmt --all, cargo clippy -p lcg-core -- -D warnings, new tests pass.
• End to end against a real OpenAI-compatible gateway fronting Claude: knowledge_process_chunk on a short paragraph extracted 7 entities / 7 edges, and the gateway's ```json-fenced responses were recovered by the existing fence handling.

Notes

• Scope is deliberately small: no new CLI flag, since the embedder side also uses env-only for its key. Happy to add --extractor-api-key if you'd prefer symmetry with the flags.
• Not a Fabrik/Spec Kit feature per CLAUDE.md's threshold; treated as a focused fix. Let me know if you'd rather it go through an issue first.

🤖 Generated with Claude Code

[handarbeit-pruefer]

Reviewed the addition of LCG_EXTRACTION_API_KEY / with_api_key to OaiExtractor (crates/core/src/extractor.rs), its wiring in from_env/new_http/new_uds, the two new header-capturing unit tests, and the docs/configuration.md entry. Traced how the key flows through send_chat's HTTP branch (bearer_auth), confirmed the UDS transport unconditionally forces api_key: None (including when with_api_key is called on a UDS-backed instance), and checked that cassette recording (RecordingExtractor) operates at the Extractor-trait level and never captures raw HTTP headers, so the token can't leak into recorded cassettes or stderr logging in crates/service/src/main.rs. Empty-string keys are filtered consistently at both the env-read and builder call sites. The change is small, mirrors the existing embedder pattern closely, and is well covered by tests. No bugs, security issues, or design problems found.