Force-refresh now also clears env vars that were previously injected by the
keystore but no longer exist in the current injectable secret set. This lets
credential deletion/revocation propagate in long-lived gateway processes
without restart, while still preserving external env precedence.
Adds a regression test covering deletion of a keystore-backed OPENAI_API_KEY
followed by gateway refresh.
Shannon Sands
712bdfb949