#23026: Onboard: move volcengine/byteplus auth from .env to profiles

## Summary - migrate Volcengine and BytePlus onboarding auth persistence from shared `.env` writes to auth-profile credentials - add provider-specific profile setters and wire both interactive and non-interactive auth-choice flows to use them - support env-backed secure persistence by storing `keyRef: { source: "env", id: "VOLCENGINE_API_KEY" | "BYTEPLUS_API_KEY" }` when input is env-backed/`${ENV}` - preserve plaintext fallback when users provide a literal key not backed by environment variables ## User-visible Behavior - onboarding no longer writes Volcengine/BytePlus static keys into `~/.openclaw/.env` on migrated paths - these providers now follow the same profile-based auth storage model as OpenAI and other migrated providers ## Scope Boundary - no change to provider request wiring or runtime secret resolution contract - no OAuth token handling in this PR ## Validation - `pnpm check` - `pnpm vitest run src/commands/onboard-auth.credentials.test.ts src/commands/auth-choice.apply.volcengine-byteplus.test.ts`