refactor(embedding-providers): rename --inline-api-key to --provider-api-key

Renames the flag (and Rust struct field) on `embedding-providers create`
and `embedding-providers update` from `--inline-api-key` /
`inline_api_key` to `--provider-api-key` / `provider_api_key`.

Why:
- Pairs naturally with the existing `--provider-type` flag on the same
  subcommand (consistent prefix family).
- Self-documenting: this is the embedding service's own API key (e.g.
  an OpenAI sk-... key), not the user's Hotdata auth credential.
- Avoids the clap field-id collision with the global `Cli::api_key`
  that motivated the original rename, but does so via a name that
  reads more naturally than `--inline-api-key`.

The JSON request body field stays `api_key` per the OpenAPI schema —
only the user-facing CLI flag and Rust field are renamed.

Author: anoop-narang

README.md

@@ -248,15 +248,15 @@ hotdata indexes delete --dataset-id <id> --name <name>
 hotdata embedding-providers list [-o table|json|yaml]
 hotdata embedding-providers get <id> [-o table|json|yaml]
 hotdata embedding-providers create --name <name> --provider-type service|local \
-  [--config '<json>'] [--inline-api-key <key> | --secret-name <name>]
+  [--config '<json>'] [--provider-api-key <key> | --secret-name <name>]
 hotdata embedding-providers update <id> [--name <name>] [--config '<json>'] \
-  [--inline-api-key <key> | --secret-name <name>]
+  [--provider-api-key <key> | --secret-name <name>]
 hotdata embedding-providers delete <id>
 ```
 
 - `list`/`get` show registered providers (system providers like `sys_emb_openai` come pre-configured).
-- `--inline-api-key` auto-creates a managed secret for the provider; `--secret-name` references an existing secret. They are mutually exclusive.
-- The flag is `--inline-api-key` (not `--api-key`) to avoid colliding with the global `--api-key` auth flag.
+- `--provider-api-key` auto-creates a managed secret for the provider; `--secret-name` references an existing secret. They are mutually exclusive.
+- `--provider-api-key` pairs with `--provider-type` and avoids colliding with the global `--api-key` (Hotdata auth).
 
 ## Results
 

skills/hotdata/SKILL.md

@@ -343,12 +343,12 @@ hotdata indexes delete --dataset-id <dataset_id> --name <name>
 hotdata embedding-providers list [--workspace-id <workspace_id>] [--output table|json|yaml]
 hotdata embedding-providers get <id> [--workspace-id <workspace_id>] [--output table|json|yaml]
 hotdata embedding-providers create --name <name> --provider-type service|local \
-  [--config '<json>'] [--inline-api-key <key> | --secret-name <name>] [--workspace-id <workspace_id>]
-hotdata embedding-providers update <id> [--name <name>] [--config '<json>'] [--inline-api-key <key> | --secret-name <name>]
+  [--config '<json>'] [--provider-api-key <key> | --secret-name <name>] [--workspace-id <workspace_id>]
+hotdata embedding-providers update <id> [--name <name>] [--config '<json>'] [--provider-api-key <key> | --secret-name <name>]
 hotdata embedding-providers delete <id> [--workspace-id <workspace_id>]
 ```
 - System providers (e.g. `sys_emb_openai`) come pre-configured. `list` shows IDs to pass to `--embedding-provider-id`.
-- `--inline-api-key` (not `--api-key`, to avoid the global auth flag) auto-creates a managed secret. `--secret-name` references an existing secret. Mutually exclusive.
+- `--provider-api-key` (the embedding service's own key, e.g. an OpenAI `sk-...`) auto-creates a managed secret. Pairs with `--provider-type`; named to avoid colliding with the global `--api-key` (Hotdata auth). `--secret-name` references an existing secret. Mutually exclusive.
 
 ### Jobs
 ```

src/command.rs

@@ -793,11 +793,12 @@ pub enum EmbeddingProvidersCommands {
         #[arg(long)]
         config: Option<String>,
 
-        /// Inline API key (auto-creates a managed secret). Mutually exclusive with --secret-name.
-        /// Named `--inline-api-key` (and field `inline_api_key`) to avoid collision with the
-        /// global `--api-key` / `Cli::api_key` auth flag.
-        #[arg(long = "inline-api-key", conflicts_with = "secret_name")]
-        inline_api_key: Option<String>,
+        /// The provider's own API key (e.g. an OpenAI sk-... key). Auto-creates a
+        /// managed secret. Mutually exclusive with --secret-name. Named
+        /// `--provider-api-key` to pair with `--provider-type` and to avoid colliding
+        /// with the global `--api-key` (Hotdata auth) flag.
+        #[arg(long = "provider-api-key", conflicts_with = "secret_name")]
+        provider_api_key: Option<String>,
 
         /// Reference an existing secret by name (for service providers)
         #[arg(long)]
@@ -821,11 +822,10 @@ pub enum EmbeddingProvidersCommands {
         #[arg(long)]
         config: Option<String>,
 
-        /// New inline API key (replaces or creates the managed secret).
-        /// Named `--inline-api-key` (and field `inline_api_key`) to avoid collision with the
-        /// global `--api-key` / `Cli::api_key` auth flag.
-        #[arg(long = "inline-api-key", conflicts_with = "secret_name")]
-        inline_api_key: Option<String>,
+        /// New provider API key (replaces or creates the managed secret).
+        /// See `embedding-providers create --provider-api-key` for naming rationale.
+        #[arg(long = "provider-api-key", conflicts_with = "secret_name")]
+        provider_api_key: Option<String>,
 
         /// New secret name to reference
         #[arg(long)]

src/main.rs

@@ -519,31 +519,31 @@ fn main() {
                         name,
                         provider_type,
                         config,
-                        inline_api_key,
+                        provider_api_key,
                         secret_name,
                         output,
                     } => embedding_providers::create(
                         &workspace_id,
                         &name,
                         &provider_type,
                         config.as_deref(),
-                        inline_api_key.as_deref(),
+                        provider_api_key.as_deref(),
                         secret_name.as_deref(),
                         &output,
                     ),
                     EmbeddingProvidersCommands::Update {
                         id,
                         name,
                         config,
-                        inline_api_key,
+                        provider_api_key,
                         secret_name,
                         output,
                     } => embedding_providers::update(
                         &workspace_id,
                         &id,
                         name.as_deref(),
                         config.as_deref(),
-                        inline_api_key.as_deref(),
+                        provider_api_key.as_deref(),
                         secret_name.as_deref(),
                         &output,
                     ),