test(env): isolate os.environ in env_loader test so it doesn't leak keys into later tests

feat(web): load API keys from git-ignored .env at startup (fixes ollama:*-cloud key error)