#356 LLM tool: Use Secret Manager for API keys

## Issue llm.py only reads API keys from environment variables, not from Secret Manager. ## Current Behavior - API keys come only from env vars (OPENAI_API_KEY, etc.) - No integration with Vault/Secret Manager ## Recommended Fix 1. Add optional secret_id parameter for API key lookup 2. If secret_id provided, fetch from Secret Manager 3. Fall back to env var if no secret_id ## Example Usage builder.task( 'llm_call', 'tools.llm.call', kwargs={ 'provider': 'openai', 'model': 'gpt-4', 'prompt': '...', 'api_key_secret_id': 'uuid-of-secret' # NEW } ) ## Location engine/tools/llm.py