KeyResolver now wraps getApiKey in try/catch and falls back to env instead of crashing startup. ProvidersStore.getApiKey returns undefined when the cipher is disabled rather than throwing. Server starts cleanly with env-only, and uses the encrypted DB key when the master key is present.