Persist an API key for provider.
Empty / whitespace-only keys are rejected so callers don't accidentally
write a sentinel that masks a working environment variable (see
apply_stored_credentials in model_config — a stored empty would
unconditionally overwrite the env var).
Provider identifier (e.g., "anthropic").
The API key value. Whitespace is stripped before storage.
Optional provider endpoint to pair with the key. Whitespace
is stripped; blank/None stores no endpoint, meaning the key uses
the provider default rather than any inherited (e.g. gateway) URL.
