Prefer --api-key over STRIPE_API_KEY

[EfeDurmaz16]

Summary

• make the explicit --api-key override take precedence over STRIPE_API_KEY
• keep STRIPE_API_KEY as the fallback before persisted config/keychain credentials
• update whoami key classification and regression tests for flag/env precedence

Closes #1581.

Testing

• go test ./pkg/config -run TestGetAPIKey
• env HOME=$(mktemp -d) go test ./pkg/cmd -run TestWhoami
• env HOME=$(mktemp -d) go test ./pkg/config ./pkg/cmd -run 'TestGetAPIKey|TestWhoami'

Note: a non-isolated local go test ./pkg/config ./pkg/cmd reads my machine's existing Stripe config and also hits an existing TestGetLoginEmpty template-state failure. The focused regression tests above pass with an isolated HOME.

[cla-assistant]

All committers have signed the CLA.

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[cla-assistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}