fix: Remove clear-text storage of API key (CodeQL alert #8)

- Remove api_key parameter from generate_api_config()
- Update API_CONFIG_TEMPLATE to read TEST_API_KEY from environment at runtime
- Pass TEST_API_KEY via Docker env vars instead of writing to config file
- Fixes py/clear-text-storage-sensitive-data vulnerability
- API key is now read from os.environ.get('TEST_API_KEY') at runtime

test/finetune/test_benchmark_api.py

@@ -272,6 +272,8 @@ def run_benchmark_api(
         # Pass API credentials for use inside Docker
         "OPENAI_API_KEY": api_key,
         "OPENAI_BASE_URL": docker_api_base_sdk,  # SDK auto-appends /chat/completions
+        # Security: Pass TEST_API_KEY for config file to read at runtime (not stored in file)
+        "TEST_API_KEY": api_key,
     }
     # Add HF token for gated datasets (e.g., ChemCoTBench)
     if hf_token: