pub fn validate_key(key: &str) -> Result<(), String>
Validate header-safe provider credentials without returning secrets in errors.