[jadb]

An empty key reads as missing for every provider in foo provider show and foo model list.

Bug

internal/llm/auth.go resolveCatalogAuth (catalog providers no kit adapter serves) accepted store.Get(...) when the result was non-nil, without checking the value. foo's default env secret backend uses os.LookupEnv, so a variable set to "" returned an empty secret and the provider showed configured. Providers kit serves (built-ins, protocol-routed catalog providers) were already right: kit skips empty values for every source.

Fix

• New lookupCatalogKey, same rule as kit: secret store first, then the environment; only a non-empty value counts. Reuses namedStore, so "empty is missing" lives in one place.
• Adjacent gap: with no store, or a keyring store, these providers read only the store, so an exported key showed missing; they now fall back to the environment, as kit does.
• LLM_API_KEY and llm.yaml still never apply to adapterless providers (kit won't lend a key to a provider no run can reach).
• A whitespace-only value counts as a key everywhere, matching kit (documented).

Tests

• internal/llm/emptykey_test.go: 3 provider kinds (openai; fixturecompat, protocol-routed; fixturecloud, no adapter) × 7 sources × 4 key states; provider show status, model list visibility and the run precheck (exit 5) agree. Plus: an empty key doesn't count toward the "configured providers" hint.
• e2e fixture adds fixturecompat; TestCLI_Provider adds empty-key show cases for all three and empty-key runs (openai://gpt-4o, fixturecompat://compat-1) that must exit 5.

Docs

commands.md (provider show), config.md (key precedence): empty is no key, spaces are sent as written, adapterless catalog providers look up only the catalog's variables (store, then env).