fix: validate api key before serve setup

maintainer edit: Check api.api_key before template sync and AgentLoop construction so missing-key startup errors are not hidden by provider or workspace initialization failures.

tests/cli/test_commands.py

@@ -2901,6 +2901,7 @@ def test_serve_rejects_loopback_without_api_key(monkeypatch, tmp_path: Path) ->
 
     assert result.exit_code == 1
     assert "api_key is not set" in result.stdout
+    assert "workspace" not in seen
     assert "api_app" not in seen
 
 
@@ -2929,6 +2930,7 @@ def test_serve_rejects_wildcard_host_without_api_key(monkeypatch, tmp_path: Path
 
     assert result.exit_code == 1
     assert "api_key is not set" in result.stdout
+    assert "workspace" not in seen
     assert "api_app" not in seen