feat(talk): read API key from agenix file instead of env var

Primary: /run/agenix/elevenlabs-key (read via 'read -r' which strips
the trailing newline agenix files contain).
Fallback: ELEVENLABS_API_KEY env var (backwards compatible).

No need to export the key in shell environment anymore — if the
agenix secret exists, talk picks it up automatically.

Override path via ELEVENLABS_KEY_FILE env var if needed.

pkgs/talk/default.nix

@@ -23,7 +23,18 @@
     fi
 
     # ── Config ──────────────────────────────────────────────────────
-    API_KEY="''${ELEVENLABS_API_KEY:?Set ELEVENLABS_API_KEY in your environment}"
+    # API key: read from agenix file (preferred), fall back to env var.
+    # `read -r` strips the trailing newline that agenix files contain.
+    ELEVENLABS_KEY_FILE="''${ELEVENLABS_KEY_FILE:-/run/agenix/elevenlabs-key}"
+    if [ -f "$ELEVENLABS_KEY_FILE" ]; then
+      read -r API_KEY < "$ELEVENLABS_KEY_FILE"
+    elif [ -n "''${ELEVENLABS_API_KEY:-}" ]; then
+      API_KEY="''${ELEVENLABS_API_KEY}"
+    else
+      echo "Error: No ElevenLabs API key found." >&2
+      echo "Create $ELEVENLABS_KEY_FILE (agenix) or set ELEVENLABS_API_KEY env var." >&2
+      exit 1
+    fi
     VOICE_ID="''${ELEVENLABS_VOICE_ID:-KXxZd16DiBqt82nbarJx}"
     # Argument hat Vorrang, sonst stdin lesen wenn Pipe
     if [ $# -ge 1 ]; then