fix: strip() clés API + log masqué pour debug 401

backend/ai.py

@@ -17,19 +17,19 @@ ProviderName = Literal["deepseek", "openrouter", "gemini"]
 # Provider configurations
 PROVIDERS = {
     "deepseek": {
-        "api_key": os.getenv("DEEPSEEK_API_KEY", ""),
+        "api_key": os.getenv("DEEPSEEK_API_KEY", "").strip(),
         "base_url": "https://api.deepseek.com/v1",
         "model": os.getenv("DEEPSEEK_MODEL", "deepseek-chat"),
         "auth_header": "Bearer {api_key}",
     },
     "openrouter": {
-        "api_key": os.getenv("OPENROUTER_API_KEY", ""),
+        "api_key": os.getenv("OPENROUTER_API_KEY", "").strip(),
         "base_url": "https://openrouter.ai/api/v1",
         "model": os.getenv("OPENROUTER_MODEL", "openai/gpt-4o-mini"),
         "auth_header": "Bearer {api_key}",
     },
     "gemini": {
-        "api_key": os.getenv("GEMINI_API_KEY", ""),
+        "api_key": os.getenv("GEMINI_API_KEY", "").strip(),
         "base_url": "https://generativelanguage.googleapis.com/v1beta",
         "model": os.getenv("GEMINI_MODEL", "gemini-2.0-flash"),
         "auth_header": None,  # Uses query param ?key=
@@ -59,6 +59,9 @@ async def _call_deepseek_openrouter(prompt: str, system: str, provider: Optional
                                      temperature: float = 0.7, max_tokens: int = 2048) -> str:
     """Call OpenAI-compatible API (DeepSeek, OpenRouter)."""
     cfg = _get_provider_config(provider)
+    # Debug: log masked key to diagnose 401
+    key_preview = cfg["api_key"][:8] + "..." + cfg["api_key"][-4:] if len(cfg["api_key"]) > 12 else "***"
+    logger.info(f"AI call: provider={cfg['name']} model={cfg['model']} key={key_preview}")
     headers = {
         "Authorization": cfg["auth_header"].format(api_key=cfg["api_key"]),
         "Content-Type": "application/json",