feat: API Keys via Umgebungsvariablen konfigurierbar

- Neuer getApiKey() Helper: prüft zuerst ENV-Vars, dann DB
- Alle Job-Routes nutzen getApiKey() statt direktem DB-Lookup
- Credentials-Status berücksichtigt ENV-Vars (Sidebar-Haken)
- .env.local.example: Platzhalter für alle 4 API Keys

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/jobs/airscale-enrich/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/db";
-import { decrypt } from "@/lib/utils/encryption";
+import { getApiKey } from "@/lib/utils/apiKey";
 import { cleanDomain } from "@/lib/utils/domains";
 import { bulkSearchDomains, type DecisionMakerCategory } from "@/lib/services/anymailfinder";
 
@@ -16,11 +16,8 @@ export async function POST(req: NextRequest) {
       return NextResponse.json({ error: "No companies provided" }, { status: 400 });
     }
 
-    const cred = await prisma.apiCredential.findUnique({ where: { service: "anymailfinder" } });
-    if (!cred?.value) {
-      return NextResponse.json({ error: "Anymailfinder API key not configured" }, { status: 400 });
-    }
-    const apiKey = decrypt(cred.value);
+    const apiKey = await getApiKey("anymailfinder");
+    if (!apiKey) return NextResponse.json({ error: "Anymailfinder API key not configured" }, { status: 400 });
 
     // Build domain → company map
     const domainMap = new Map<string, string>();