Triage Review ✅

Clean targeted fix for the provider detection gap in #604.

What it does:

• Adds XAI_API_KEY → x-ai and MISTRAL_API_KEY → mistralai to both the env var key list scan and the explicit detected_providers.add() block — consistent with how every other provider is handled
• Adds a new cfg.get("providers", {}) scan so users who set provider API keys directly in config.yaml (without a corresponding env var) are also detected — only adds providers present in _PROVIDER_MODELS, preventing phantom entries

Code review:

• api/config.py diff is minimal and surgical (+15 lines) — no side effects risk
• Both env var additions follow the existing pattern exactly (list scan + explicit add block)
• The config.yaml scan correctly guards against non-dict values (isinstance(_cfg_providers, dict)) and only allows known providers — safe
• 12 regression tests cover both code paths (env vars and config.yaml detection) plus provider catalog completeness checks

One note: XAI_API_KEY is added both to the list at line ~1413 and as an explicit if all_env.get("XAI_API_KEY") block below — this mirrors the pattern used by other providers (e.g. OPENCODE_ZEN_API_KEY), so it's correct; the list scan feeds the credential pool path, the explicit block covers the all_env path.

Ready to merge. Addresses the core detection gap from #604.

Absorbed and shipped in v0.50.223 (PR #1127). Thanks!