Source API keys from environment/CI secrets instead of committed credentials

[Bill-Becker]

Removes committed API credentials from the repo and sources them from environment variables / GitHub Actions secrets instead. Follows up on the test/.env finding from the Copilot review on #626.

Changes

• Untrack test/.env (git rm --cached) and add .env to .gitignore. Local developer files are unaffected.
• Add committed test/.env.example template with placeholders and signup URLs.
• .github/workflows/CI.yml: add an env: block on the test step mapping NLR_DEVELOPER_API_KEY, URDB_API_KEY, and NLR_DEVELOPER_EMAIL from repo secrets.
• src/core/urdb.jl: remove the hardcoded URDB API key fallback. Replaced with get_urdb_api_key(), which reads ENV and throws a descriptive error when unset, mirroring check_api_key() in src/core/utils.jl. It is called at request time, so the package still loads without a key set.
• Docs: new URDB API key section in docs/src/index.md plus a note about copying test/.env.example to test/.env.
• CHANGELOG entry under a new ## Develop section.

No real key values are committed anywhere.

Required before merge

1. Add three repository secrets under Settings -> Secrets and variables -> Actions: NLR_DEVELOPER_API_KEY, URDB_API_KEY, NLR_DEVELOPER_EMAIL. CI will fail without them.
2. Rotate both API keys. The old values remain in git history, so removing them from HEAD does not make them secret.

[Copilot]

🟡 Changes recommended

The new URDB missing-key path uses throw(@error(...)), which won’t raise the intended exception, and the CI secret injection likely hard-fails for fork PRs where secrets are unavailable.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR removes committed API credentials from the repository and switches both local testing and CI to source required API keys/emails from environment variables (and GitHub Actions secrets), with updated docs and changelog notes to reflect the new setup.

Changes:

• Stop tracking test/.env and add an example template test/.env.example for local developer setup.
• Remove the hardcoded URDB API key fallback and read URDB_API_KEY from ENV at request time with a descriptive error when unset.
• Update CI and docs to supply/describe required environment variables; add changelog entries for the change.

File summaries

File	Description
test/.env.example	Adds a safe template for local test env vars without committing secrets.
test/.env	Removes previously committed credentials from version control.
src/core/urdb.jl	Switches URDB authentication to ENV["URDB_API_KEY"] and removes hardcoded fallback.
docs/src/index.md	Documents how to set URDB_API_KEY and how local tests load env vars from test/.env.
CHANGELOG.md	Records the credential-handling change and updates changelog workflow guidance.
.gitignore	Ensures .env files are ignored to prevent accidental secret commits.
.github/workflows/CI.yml	Injects NLR_DEVELOPER_API_KEY, URDB_API_KEY, and NLR_DEVELOPER_EMAIL via GitHub Actions secrets.

Review details

• Files reviewed: 6/7 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

The CI workflow currently skips the test step for forked PRs while still reporting success, which can allow untested changes to merge unnoticed.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Review details

Suppressed comments (2)

Previously missed (2) — in code that hasn't changed since the last review.

docs/src/index.md:25

• urdb_rate_name is referenced without the ElectricTariff. prefix here, while the surrounding parameters use fully-qualified field names. Using the same prefix for both fields makes the docs easier to follow.
  src/core/urdb.jl:11
• The guidance in this error message uses Python-style quoting (single quotes) for ENV[...], which is not valid Julia syntax and may confuse users following the instructions. Update the example to ENV["URDB_API_KEY"] = "...".

• Files reviewed: 6/7 changed files
• Comments generated: 1
• Review effort level: Lite