feat: API Keys via Umgebungsvariablen konfigurierbar

- Neuer getApiKey() Helper: prüft zuerst ENV-Vars, dann DB
- Alle Job-Routes nutzen getApiKey() statt direktem DB-Lookup
- Credentials-Status berücksichtigt ENV-Vars (Sidebar-Haken)
- .env.local.example: Platzhalter für alle 4 API Keys

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

lib/utils/apiKey.ts

@@ -0,0 +1,23 @@
+import { prisma } from "@/lib/db";
+import { decrypt } from "./encryption";
+
+const ENV_VARS: Record<string, string> = {
+  anymailfinder: "ANYMAILFINDER_API_KEY",
+  apify: "APIFY_API_KEY",
+  vayne: "VAYNE_API_KEY",
+  googlemaps: "GOOGLE_MAPS_API_KEY",
+};
+
+export async function getApiKey(service: string): Promise<string | null> {
+  const envVar = ENV_VARS[service];
+  if (envVar && process.env[envVar]) return process.env[envVar]!;
+
+  const cred = await prisma.apiCredential.findUnique({ where: { service } });
+  if (!cred?.value) return null;
+  return decrypt(cred.value);
+}
+
+export function hasApiKeyFromEnv(service: string): boolean {
+  const envVar = ENV_VARS[service];
+  return !!(envVar && process.env[envVar]);
+}