Simplify API-key delivery and align runtime behavior

[Hou (SciencePotato)]

Summary

• Align JavaScript, Python and .NET with the same API-key delivery contract and configuration-driven adapter selection.
• Await provider acceptance before acknowledging the nonce; fail closed on HTTP failures, malformed statuses, missing credentials and timeouts.
• Preserve inbound Entra authentication and authenticated JWE decryption. No outbound provider-token acquisition.
• Use request evaluation mode for generic non-delivery checks; preserve rendered messages without passcode rewriting.
• Centralize shared configuration, keep the expected encryption key ID advisory, and use privacy-limited logging.
• Keep documentation provider-neutral, consolidate Git ignore rules and exclude local settings/private keys from deployment packages.
• Compact tests and comments, remove the duplicate Git ignore/retired test file and omit one-off internal reports and local test helpers.

Verification

• 52 offline tests passed: 18 JavaScript, 16 Python, 18 .NET.
• .NET build/publish and Git whitespace checks passed.
• Current code deployed to the three existing test Function Apps; deployment artifacts were verified against uploaded packages.
• Nine live Azure requests across three languages and three adapter configurations returned HTTP 200 with matching nonce/correlation values. This includes three checks after updating the externally stored API credential pair.
• Easy Auth and in-process authentication stayed enabled. Original temporary caller/provider settings were restored, unauthorized requests were rejected again, and temporary test credentials were deleted.
• No automatic live-request retries. No credentials, local settings, keys or helper scripts are included in this PR.

Limits

• Provider acceptance is not confirmation of handset receipt.
• The fourth adapter was not live-tested because its API token is unavailable.
• Cold/restart latency can exceed the caller's end-to-end budget; the provider timeout is not a whole-invocation deadline.
• Production limitations remain documented in the shared contract. This is not full provider or production certification.