Prefer env vars over secret store for API credentials

All scripts now check GLM_API_KEY / TK_AI_API_TOKEN environment
variables first, falling back to Keychain/libsecret only when unset.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

claude-glm

@@ -13,6 +13,10 @@
 
 KEY_NAME="GLM_API_KEY"
 
+if [ -n "${!KEY_NAME}" ]; then
+  TOKEN="${!KEY_NAME}"
+fi
+
 get_token() {
   if command -v security >/dev/null 2>&1; then
     security find-generic-password -s "$KEY_NAME" -w 2>/dev/null && return
@@ -23,7 +27,9 @@ get_token() {
   return 1
 }
 
-TOKEN=$(get_token)
+if [ -z "$TOKEN" ]; then
+  TOKEN=$(get_token)
+fi
 
 if [ -z "$TOKEN" ]; then
   echo "❌ Missing GLM token ($KEY_NAME)"