ops(ci): configure LLM API keys in Forgejo CI for integration test execution

Updated CI pipeline to inject ANTHROPIC_API_KEY and OPENAI_API_KEY
secrets as environment variables during Robot Framework integration
test execution. Added CI setup documentation.

ISSUES CLOSED: #701

.forgejo/workflows/ci.yml

@@ -149,6 +149,12 @@ jobs:
                   nox -s integration_tests
               env:
                   NOX_DEFAULT_VENV_BACKEND: uv
+                  # LLM API keys required for Robot Framework integration tests.
+                  # These secrets must be configured in Forgejo UI:
+                  #   Repository Settings > Actions > Secrets
+                  # See docs/development/ci-cd.md for details.
+                  ANTHROPIC_API_KEY: ${{ secrets.ANTHROPIC_API_KEY }}
+                  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}
 
     e2e_tests:
         runs-on: docker

docs/development/ci-cd.md

@@ -244,6 +244,32 @@ sessions use `uv` as the venv backend (`venv_backend="uv"`) and reuse
 existing virtualenvs (`reuse_venv=True`) for speed. On CI, each job starts
 fresh but `uv` provides fast installs via its built-in caching.
 
+### CI Secrets
+
+Some CI jobs require secrets configured in the Forgejo UI. Secrets are managed
+under **Repository Settings > Actions > Secrets** and are automatically masked
+in job logs.
+
+| Secret Name | Required By | Purpose |
+|-------------|-------------|---------|
+| `ANTHROPIC_API_KEY` | `integration_tests` | Anthropic API key for Robot Framework integration tests |
+| `OPENAI_API_KEY` | `integration_tests` | OpenAI API key for Robot Framework integration tests |
+| `AWS_ACCESS_KEY_ID` | `benchmark-regression`, `benchmark-publish` | AWS credentials for ASV benchmark S3 storage |
+| `AWS_SECRET_ACCESS_KEY` | `benchmark-regression`, `benchmark-publish` | AWS credentials for ASV benchmark S3 storage |
+| `AWS_DEFAULT_REGION` | `benchmark-regression`, `benchmark-publish` | AWS region for ASV benchmark S3 storage |
+| `ASV_S3_BUCKET` | `benchmark-regression`, `benchmark-publish` | S3 bucket name for ASV benchmark storage |
+
+**Unit tests vs. integration tests:**
+
+- **Unit tests** (Behave BDD, `nox -s unit_tests`) do **not** require any API
+  keys. They test internal logic without calling external services.
+- **Integration tests** (Robot Framework, `nox -s integration_tests`) **do**
+  require real LLM API keys (`ANTHROPIC_API_KEY`, `OPENAI_API_KEY`). These
+  tests exercise end-to-end workflows that interact with live LLM providers.
+
+If the LLM secrets are not configured, integration tests will fail with
+authentication errors at runtime.
+
 ### Pre-commit Hooks
 
 Pre-commit hooks run automatically on `git commit` and catch most issues before