fix: honest API-key gating in the Add-column dialog

[aaronjmars]

Problem

The Add-column picker under-reported which columns need a key. It dimmed a source only from capabilities.requiresEnv, and two things were off:

1. github-stars and github-discussions hard-require a GITHUB_TOKEN (stargazers list is auth-gated; Discussions GraphQL gives unauthenticated requests ~0 quota) but declared it only in free-text rateLimitHint — so they showed as ready and only failed on refresh.
2. The 6 xAI columns did declare requiresEnv, but .env.example ships XAI_API_KEY=xai-... — a non-empty placeholder. Boolean(process.env.XAI_API_KEY) counted it as configured, so those columns looked ready but failed on refresh with an opaque xAI "Incorrect API key", and Settings reported the key as set. ./minitor doctor already rejects the same placeholder.

Net: the UI showed 6 key-gated columns when 8 actually can't fetch without a credential — and even those 6 weren't dimmed when a placeholder was present.

Fix

• Declare requiresEnv: ["GITHUB_TOKEN"] on github-stars + github-discussions.
• Add a pure, client-safe isPlaceholderValue() to lib/env-keys.ts (blank or contains an ellipsis .../…) and route all three key-presence reads through it: getKeyAvailability (dialog dimming), getEnvKeysStatus (Settings), and callGrok (fetch-time).

Now the dialog dims all 8 key-gated columns honestly in every env state, and a leftover placeholder fails with a clear "XAI_API_KEY is not set" instead of a bounced upstream call.

Verification

• Live UI: 8 columns now dim with the key icon (6 xAI + stars + discussions), verified via DOM.
• x-trending with the placeholder key → "XAI_API_KEY is not set in .env.local (still the .env.example placeholder?)" (was "Incorrect API key").
• Keyless columns unaffected (e.g. hacker-news still returns items).
• npm test → 275 pass (added test/env-keys.test.ts); eslint clean.