Something worth telling the user that does not stop the rest of the
file being used.
These were tracing::warn! calls and nothing else, which the CLI’s
EnvFilter::from_default_env() suppresses at the default level — so the
permission warning docs/CONFIG.md §6 promises, and the “you typed a key
that did not load” line, reached nobody. Carrying them as data lets
config doctor print them, and lets tests assert on them rather than on
log output that no assertion can see.
File-level failures (unreadable, malformed) are CredentialsError
instead: those invalidate the whole file rather than one entry.
Non-exhaustive enums could have additional variants added in future. Therefore, when matching against variants of non-exhaustive enums, an extra wildcard arm must be added to account for any future variants.
api_key is present but blank, so it cannot authenticate.
Covers both api_key = "" and a whitespace-only value. The first is
the commoner typo and was, before this, indistinguishable from the
key being absent — Option::unwrap_or_default() collapsed None and
Some("") to the same empty string.