feat(skaldsong): pass SKALDSONG_COMPLETER_API_KEY to the container

Since skaldsong v0.39.0 the structured pipeline passes call the LiteLLM
gateway directly; with no key every story generation fails 401 at its first
pass. Operator ruling 2026-10-05: the shared all-agents key until Skaldsong
v1.0 final, then a project-scoped key. The stack passes an explicit
environment list, so the .env line alone does not reach the container.

stacks/skaldsong/.env.example

@@ -33,6 +33,11 @@ SKALDSONG_RUNS_DIR_HOST=/opt/docker/conf/skaldsong/runs
 # /heimdall:rotate flow if compromise suspected.
 SKALDSONG_BIFROST_JWT_KEY=
 
+# LiteLLM gateway key for the pipeline passes (skaldsong >= v0.39.0). Until
+# v1.0 final: the shared all-agents key, vault `litellm/all-agents-shared-key`
+# (operator 2026-10-05). It reaches PAID models too. Then a project-scoped key.
+SKALDSONG_COMPLETER_API_KEY=
+
 # URL Worldtree uses to call BACK to skaldsong's Bifrost endpoint at
 # tool-dispatch time. Must match Worldtree's BIFROST_CLIENT_ALLOWED_HOSTS
 # entry. From ana-docker LAN: http://10.250.50.70:8300 (this port).

stacks/skaldsong/compose.yaml

@@ -40,6 +40,14 @@ services:
       # holds the real value.
       SKALDSONG_BIFROST_JWT_KEY: "${SKALDSONG_BIFROST_JWT_KEY:-}"
 
+      # LiteLLM gateway key for the structured pipeline passes (since skaldsong
+      # v0.39.0 each pass calls http://10.250.50.70:4000 directly; base_url is
+      # baked into the image). Without it every story generation 401s at its
+      # first pass; the wizard and reader do not use it. Operator ruling
+      # 2026-10-05: the shared all-agents key (vault litellm/all-agents-shared-key)
+      # until Skaldsong v1.0 final, then a project-scoped key. NEVER commit; .env.
+      SKALDSONG_COMPLETER_API_KEY: "${SKALDSONG_COMPLETER_API_KEY:-}"
+
       # URL Worldtree uses to call BACK to skaldsong's Bifrost endpoint
       # at tool-dispatch time. This is skaldsong's host-side reachable
       # URL from corviduo-dev's perspective — must match Worldtree's