feat: API Keys via Umgebungsvariablen konfigurierbar

- Neuer getApiKey() Helper: prüft zuerst ENV-Vars, dann DB
- Alle Job-Routes nutzen getApiKey() statt direktem DB-Lookup
- Credentials-Status berücksichtigt ENV-Vars (Sidebar-Haken)
- .env.local.example: Platzhalter für alle 4 API Keys

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/jobs/linkedin-enrich/route.ts

@@ -1,6 +1,6 @@
 import { NextRequest, NextResponse } from "next/server";
 import { prisma } from "@/lib/db";
-import { decrypt } from "@/lib/utils/encryption";
+import { getApiKey } from "@/lib/utils/apiKey";
 import {
   submitBulkPersonSearch,
   getBulkSearchStatus,
@@ -18,11 +18,8 @@ export async function POST(req: NextRequest) {
     };
     const { jobId, resultIds, categories } = body;
 
-    const cred = await prisma.apiCredential.findUnique({ where: { service: "anymailfinder" } });
-    if (!cred?.value) {
-      return NextResponse.json({ error: "Anymailfinder API key not configured" }, { status: 400 });
-    }
-    const apiKey = decrypt(cred.value);
+    const apiKey = await getApiKey("anymailfinder");
+    if (!apiKey) return NextResponse.json({ error: "Anymailfinder API key not configured" }, { status: 400 });
 
     const results = await prisma.leadResult.findMany({
       where: { id: { in: resultIds }, jobId, domain: { not: null } },