fix: address Gadfly findings on kimi provider

- kimi:// DSN scheme: missing-credential hint now names the LLM_<NAME> env
  var that defines the provider (its token comes from the DSN, not
  KIMI_API_KEY), matching providerFor's lazy-resolution key form. Fixes the
  correctness/error-handling findings that the old hint misdirected users to
  set KIMI_API_KEY when the fix is adding a token to the DSN.
- parse_test.go: add kimi to TestBuiltinsResolve. (llama-swap stays excluded
  and is now documented — its no-URL built-in errors at Model() construction,
  not just on use, so it can't resolve there; the finding's llama-swap half
  was a false lead the test surfaced.)
- Add TestKimiSchemeMissingToken covering the corrected hint.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

builtin_kimi_test.go

@@ -136,3 +136,36 @@ func TestKimiScheme(t *testing.T) {
 		t.Errorf("Authorization = %q, want %q", rt.req.Header.Get("Authorization"), want)
 	}
 }
+
+// TestKimiSchemeMissingToken: a kimi:// DSN with no token is fixed by adding one
+// to the DSN, not by setting KIMI_API_KEY — so the missing-key hint names the
+// defining LLM_<NAME> env var, never KIMI_API_KEY (which does nothing for a
+// DSN-defined provider).
+func TestKimiSchemeMissingToken(t *testing.T) {
+	rt := &captureRT{body: kimiResponse}
+	r := newTestRegistry(t, WithHTTPClient(&http.Client{Transport: rt}))
+	if err := r.LoadEnv(map[string]string{
+		"LLM_KCN": "kimi://api.moonshot.cn/v1", // no token
+	}); err != nil {
+		t.Fatalf("LoadEnv: %v", err)
+	}
+
+	m, err := r.Parse("kcn/moonshot-v1-8k")
+	if err != nil {
+		t.Fatalf("Parse: %v", err)
+	}
+	_, err = m.Generate(context.Background(), llm.Request{Messages: []llm.Message{llm.UserText("hi")}})
+	apiErr, ok := errors.AsType[*llm.APIError](err)
+	if !ok {
+		t.Fatalf("err = %v (%T), want *llm.APIError", err, err)
+	}
+	if !strings.Contains(apiErr.Message, "LLM_KCN") {
+		t.Errorf("message = %q, want it to name LLM_KCN", apiErr.Message)
+	}
+	if strings.Contains(apiErr.Message, "KIMI_API_KEY") {
+		t.Errorf("message = %q, must not name KIMI_API_KEY for a DSN provider", apiErr.Message)
+	}
+	if rt.req != nil {
+		t.Error("network was hit despite missing token")
+	}
+}