docs: add AgentENV API key authentication

examples/experimental/agentenv/README.md

@@ -28,6 +28,10 @@ docker run -d --name aenv --privileged -v /dev:/dev -p 8000:8000 -p 80:8000 \
   -e AENV_SANDBOX_PROXY_DOMAINS=<ip-with-dashes>.sslip.io \
   ghcr.io/kvcache-ai/aenv-server:latest
 curl -sf http://127.0.0.1:8000/health
+
+# The server generates an API key on first startup. Load it without printing
+# it; E2B SDK clients must use this exact value.
+export AENV_API_KEY="$(docker exec aenv cat /workspace/env/secrets/api-key)"
 ```
 
 Three parts of that command are not defaults. They exist because a training
@@ -47,7 +51,9 @@ can connect.
   long as it forwards WebSocket — episode I/O runs over `/ws`, and only the
   health check is plain HTTP.
 
-AgentENV does not enforce API keys yet — run it only on a trusted network.
+The API key authenticates requests but does not encrypt them. Do not send
+the API key over an untrusted plaintext network.
+
 Multi-node deployment (gateway + scheduler) is
 documented in the [AgentENV docs](https://kvcache-ai.github.io/AgentENV/).
 
@@ -59,9 +65,8 @@ export E2B_API_URL=http://<server>:8000       # control plane
 export E2B_SANDBOX_URL=http://<server>:8000   # data plane (envd proxy)
 # plain-HTTP deployments only; the default is https
 export OPENENV_E2B_URL_SCHEME=http
-# required, but any well-formed key passes: AgentENV does not check it, while
-# recent SDKs do validate the format client-side
-export E2B_API_KEY=e2b_0000000000000000000000000000000000000000
+# Use the API key generated by the AgentENV server
+export E2B_API_KEY="${AENV_API_KEY}"
 ```
 
 ## 3. Train