fix(openai): make api-key optional for OpenAI

[ningmeng0503]

Some OpenAI-compatible providers (e.g., free model endpoints such as opencode) do not require an API key. The current OpenAIAutoConfiguration throws an IllegalStateException at startup when
agentscope.openai.api-key is missing, which prevents these providers from being used.

This change removes the mandatory API key check from the auto-configuration. The underlying OpenAIClient already handles a missing key gracefully by omitting the Authorization header, so runtime
behavior remains correct for providers that do require authentication.

Changes:

• OpenAIAutoConfiguration: removed the apiKey == null startup validation.
• OpenAIProperties: updated Javadoc to clarify that api-key is optional for API-key-free providers.
• OpenAIAutoConfigurationTest: replaced the "must fail when API key missing" test with tests that verify the model is created successfully without an API key, including a free-provider scenario with
  a custom base-url.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[AgentScopeJavaBot]

🤖 AI Review

This PR makes the OpenAI API key optional in the Spring Boot auto-configuration, enabling use with free/no-auth OpenAI-compatible providers (e.g., opencode). The change is minimal (+25/-12, 3 files) and well-scoped: it removes the IllegalStateException thrown when agentscope.openai.api-key is missing, updates the Javadoc, and adjusts tests to reflect the new behavior.

The PR description is accurate — the downstream OpenAIClient.buildHeaders() (line 541) already handles null apiKey gracefully by omitting the Authorization header.

The change is backwards-compatible: existing configurations with API keys work identically.

---

[AgentScopeJavaBot]

🤖 AI Review

This PR makes the OpenAI API key optional in the Spring Boot auto-configuration, enabling use with free/no-auth OpenAI-compatible providers (e.g., opencode). The change is minimal (+25/-12, 3 files) and well-scoped: it removes the IllegalStateException thrown when agentscope.openai.api-key is missing, updates the Javadoc, and adjusts tests to reflect the new behavior.

The PR description is accurate — the downstream OpenAIClient.buildHeaders() (line 541) already handles null apiKey gracefully by omitting the Authorization header.

The change is backwards-compatible: existing configurations with API keys work identically.

---