fix: defer API key resolution in generate.NewGenerator to call time

[MacAttak]

Problem

generate.NewGenerator() reads ANTHROPIC_API_KEY, OPENAI_API_KEY, and GEMINI_API_KEY from the environment at construction time in BuildRootCommand(). This means:

1. Every toolwright invocation stores API keys in memory even when generate manifest is never called.
2. Tests that call BuildRootCommand() and set env vars mid-test won't see the updated values.

Context

Raised in PR #14 review (comment). Deferred because it changes the NewGenerator constructor and provider wiring.

Suggested fix

Read keys lazily inside Generate() instead of at construction:

func NewGenerator() *Generator {
    return &Generator{
        providers: map[string]providerFactory{
            "anthropic": func() LLMProvider { return NewAnthropicProvider(os.Getenv("ANTHROPIC_API_KEY"), nil) },
            // ...
        },
    }
}

Or use a NewGeneratorFromEnv() that defers reads to first Generate() call.