[vigneshrajsb]

Summary

• lfc now reads an API key from LFC_API_KEY, so it can run in CI without lfc login or a config file (only LIFECYCLE_API_URL is needed).
• The key takes precedence over any cached SSO login and is sent as a Bearer token. A malformed key fails fast, and a 401 is not retried.
• lfc whoami reports the key's principal and scopes; lfc doctor notes the key is set.

Testing

• Lint, typecheck and unit tests pass.
• With a personal API key and an empty config dir: whoami, builds find, and builds env set/get/unset all worked.
• A well-formed but invalid key returns a 401 from the API.