Debug: The Hardcoded API Key

ReportSender has the API key hardcoded and falls back to it when config is missing — a credential silently ships to every environment, and missing configuration goes unnoticed. Fix it: the key must come from IConfigProvider with NO fallback; when missing, throw InvalidOperationException("ApiKey is not configured"). Tests use the provided MemoryConfig. ``csharp public interface IConfigProvider { string? Get(string key); } public sealed class MemoryConfig : IConfigProvider { public MemoryConfig(params (string, string)[] entries); } public sealed class ReportSender { public ReportSender(IConfigProvider config); public string Send(string report); // returns "sent:<key>:<len>" using the configured key } ``