fix review: profile-scope _CREDENTIAL_POOL_CACHE + getattr-safe runtime_api_key (#4247)

Codex gate caught a cross-profile leak: _CREDENTIAL_POOL_CACHE was keyed
by provider id alone, so a custom provider configured under profile A made
profile B report has_key=True from a stale cache hit (then 401 at request).
Key the cache by (active-profile auth-store path, provider id) at all
get/set/evict sites via _credential_pool_profile_tag(). Also make the two
new bare _entry.runtime_api_key reads getattr-safe (OAuth-only entries lack
the attr), matching the guard the author already applied at providers.py.
Adds a cross-profile isolation regression test.

Co-authored-by: akrhin <akrhin@users.noreply.github.com>

api/routes.py

@@ -12441,7 +12441,7 @@ def _handle_live_models(handler, parsed):
                                 _lm_entry = _lm_pool.select()
                                 if _lm_entry:
                                     if not _api_key:
-                                        _api_key = _lm_entry.runtime_api_key
+                                        _api_key = getattr(_lm_entry, "runtime_api_key", "") or ""
                                     if not _base_url:
                                         _base_url = str(getattr(_lm_entry, "base_url", "") or "").strip()
                     except ImportError: