fix(amp): update explicit API key on config change

internal/api/modules/amp/amp.go

@@ -190,6 +190,7 @@ func (m *AmpModule) OnConfigUpdated(cfg *config.Config) error {
 	// If API key changed, invalidate the cache
 	if m.secretSource != nil {
 		if ms, ok := m.secretSource.(*MultiSourceSecret); ok {
+			ms.UpdateExplicitKey(settings.UpstreamAPIKey)
 			ms.InvalidateCache()
 			log.Debug("amp secret cache invalidated due to config update")
 		}

internal/api/modules/amp/secret.go

@@ -139,6 +139,17 @@ func (s *MultiSourceSecret) InvalidateCache() {
 	s.cache = nil
 }
 
+// UpdateExplicitKey refreshes the config-provided key and clears cache.
+func (s *MultiSourceSecret) UpdateExplicitKey(key string) {
+	if s == nil {
+		return
+	}
+	s.mu.Lock()
+	s.explicitKey = strings.TrimSpace(key)
+	s.cache = nil
+	s.mu.Unlock()
+}
+
 // StaticSecretSource returns a fixed API key (for testing)
 type StaticSecretSource struct {
 	key string