Document how to set the DeepSeek API key and link it from the key hint

[Birfy]

Fixes #451

The "Add an API key to get started" dialog is DeepSeek Harness's own, and it keeps only a typed or pasted key. Per the owner decision (option a only, no upstream request), FlyBot now documents the reliable ways to set the key and links that guide from the hint it controls.

• docs/deepseek-api-key.md (new): the dialog (type or paste), the DSH credentials file (~/.dsh/.credentials.yaml, refs.DEEPSEEK_API_KEY, chmod 600, live reload), and DEEPSEEK_API_KEY in the environment or a .env file, plus which one wins. Verified against the @deepseek-ai/dsh@0.2.0-rc.2 package READMEs (dsh-credentials-local, dsh-llm-deepseek-api-key) and dsh web --dump-config.
• Missing-key error (Add a model configuration shortcut or guidance below missing API key errors #405) and the no-model setup dock: a How to set a DeepSeek API key link (new tab) under the DeepSeek chips only; other routes are unchanged. zh string added.
• README / README.zh prerequisites link the guide; docs/subsystems/core-client.md updated; changelog fragment added.

Risk tier: T1 (expected; docs + hint link)

Ran at the tip: ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify (pass), node scripts/lint-plugins.mjs tree|social|timeline (pass), node .github/scripts/changelog.mjs check, node .github/scripts/check-pack.mjs (pass). Not run: smoke test, live UI check.

[Birfy]

Self-review: PASS
Tip SHA: c2c10bc
Ran: ARCH_DOCS_BASE=origin/main TZ=UTC npm run verify (pass: core lint + arch-docs OK, plugin lint, build-client --check, ds-bot-patches check, core 1012/1012, social 273/273, tree 73/73, timeline 80/80, .github scripts 88/88, interop 37/37, live-e2e 16/16); node scripts/lint-plugins.mjs tree|social|timeline (pass); node .github/scripts/changelog.mjs check (pass); node .github/scripts/check-pack.mjs (pass); PR CI all green incl. tests-ok.
Not run: smoke test (dev/smoke.mjs), live UI check in a browser, actionlint (no workflow change).
Owner decision (a) only: adds docs/deepseek-api-key.md and a hint link; no upstream deepseek-harness request, no change to DSH or ds-bot/.
Key paths in the doc (credentials file $DSH_HOME/.credentials.yaml with refs.DEEPSEEK_API_KEY, chmod 600, env > file > cwd .env > home .env) were checked against the dsh 0.2.0-rc.2 package READMEs and dsh web --dump-config; DSH has no CLI command for keys, so none is documented.
The link appears only under DeepSeek-route missing-key errors and the no-model setup chips; other routes and failures are unchanged, and no raw provider text or key is drawn (tests cover both). English copy, zh string added; patches and client.js regenerated, CHANGELOG.md and ds-bot/ untouched.

[Birfy]

Holding the merge (maintenance, 2026-10-20 05:22 Asia/Shanghai): this T1 PR shares generated/client files (core/client.js, core/src/client/i18n.js, patches 0001/0008, docs/subsystems/core-client.md) with #461, which is T3 and awaiting owner approval. It merges right after #461 lands (then rebuilt on top of it), so #461 never goes conflicted.