fix: resolve provider base URLs from env files

[zerone0x]

Summary

• include ~/.vix/.env in credential env-file lookup
• resolve provider *_BASE_URL overrides through the same env-file search path
• cover API key and base URL resolution from .env with config tests

Fixes #29
Fixes #30

Tests

• /tmp/go-apt123/root/usr/lib/go-1.23/bin/go test ./internal/config -run 'TestResolveEnvVarSearchesHomeVixDotEnv|TestResolveProviderCredentialBaseURLFromDotEnv|TestMiMoTokenPlanCredential'
• /tmp/go-apt123/root/usr/lib/go-1.23/bin/go test ./internal/config

[kirby88]

Thanks for tackling #29 and #30. A few things to address before I can merge:

1. Security hole: a .env file in any project folder can steal the user's API key. Your change lets a .env file in the current folder change where requests are sent (ANTHROPIC_BASE_URL). But the actual API key still comes from the secure keychain. So if someone clones a shady repo that contains a .env pointing at their own server, vix will happily send the user's real key to that server. Fix: only read the base URL setting from trusted places (~/.vix/.env and the file next to the program), never from the current project folder.

2. Too magical: it quietly turns on a URL override for every provider. Your code assumes "if the key variable is FOO_API_KEY, then FOO_BASE_URL overrides the URL" — for all providers, even ones meant to always use a fixed address (like OpenRouter), with no way to turn it off. The project already has a proper, explicit way to declare these overrides in the config. Use that existing mechanism instead of guessing from the variable name.

3. Add a test for the bad case. Right now you only test that the override works. Also add a test proving a provider that shouldn't be overridable ignores a stray *_BASE_URL. An end-to-end test would be nice too.

4. Use the right Go version. Your test output shows Go 1.23, but this project needs Go 1.26+. Please re-run on the correct version.

5. Wrong co-author (blocking). Your commit lists bridge as a co-author. Our rules say AI helpers must be credited as vix, not anything else. Please change the commit's co-author line to Co-authored-by: vix <290354907+vix-agent@users.noreply.github.com>, remove the bridge one, and force-push.

[kirby88]

@zerone0x thanks again for your PR. Do you plan to address my feedback? I would like to get this merged, but if you don't plan on continuing working on it I'll close the PR. Thank you