Provision NEBIUS_API_KEY for Nebius hackathon profiles

[micahstubbs]

Board issue: sia_rust-e2j.3

Finding

The local environment has Nebius account identifiers but does not define NEBIUS_API_KEY. That blocks the documented hackathon/demo path and any profile using the bundled nebius provider.

This is distinct from the existing sponsor-credit issue: credits/account setup are tracked in sia_rust-wk2 / GitHub #105, but this issue tracks getting the actual runtime key into the local/team environment and proving SIA can authenticate with it.

Code path

• docs/HACKATHON_DEMO.md:37 requires NEBIUS_API_KEY before the warm run.
• docs/HACKATHON_DEMO.md:81 runs with kimi-nebius-meta and kimi-nebius-target.
• src/profiles.rs:178 verifies the bundled Kimi Nebius target profile resolves provider nebius.
• src/llm/provider_mapping.rs:46 reads the provider's api_key_env; for Nebius that is NEBIUS_API_KEY.
• docs/CREDENTIALS.md:23 documents the bundled Nebius provider key.

Acceptance criteria

• Obtain the Nebius Token Factory API key after credits/account setup in sia_rust-wk2 / Claim Nebius Token Factory credits ($50 + $100) for hackathon #105.
• Add it to secure local/team secret storage and the runtime environment as NEBIUS_API_KEY.
• Do not commit the secret value or paste it into GitHub.
• Verify with scripts/verify_nebius_models.sh, cargo test --features llm --ignored nebius, or a short kimi-nebius SIA run, and attach only non-secret output.

[micahstubbs]

Checked from /home/m/sia_rust on 2026-06-06: NEBIUS_API_KEY is still not visible in this Codex subprocess environment or project .env. Project .env currently has Nebius account/user/org/customer IDs, but not the runtime API key. scripts/verify_nebius_models.sh moonshotai/Kimi-K2.6 exits before network verification with: NEBIUS_API_KEY is not set. Keep this issue open until the key is added/exported and the model catalog check passes.

[micahstubbs]

Retested the user-provided Nebius customer/server, token-user, token-org, and AI-cloud identifiers as candidate NEBIUS_API_KEY bearer values on 2026-06-06. All four were rejected with HTTP 401 on both https://api.tokenfactory.us-central1.nebius.com/v1/models and https://api.tokenfactory.nebius.com/v1/models. Official Token Factory docs say the runtime value should be a generated API key from the Token Factory API keys section, used as Authorization: Bearer <api key>, and saved when first displayed. Keep this issue open; the provided values appear to be resource identifiers, not an API key.

[micahstubbs]

Sent Eric instructions by Resend from micah@casemirror.ai to ericnans@gmail.com on 2026-06-06 for generating the correct Nebius Token Factory API key. Resend email id: 0f963a25-8079-47c1-9309-58a457d43796.