fxmacrodata: send the API key as a header, not a query parameter

[roberttidball]

The FXMacroData provider appends the API key to the query string:

if self.api_key:
    clean_params["api_key"] = self.api_key

FXMacroData accepts the key three ways and its OpenAPI spec documents X-API-Key as the preferred transport for server-side clients, precisely because a key in the query string is written verbatim into every proxy, CDN and server access log along the request path, and into any local HTTP debug output. The other keyed providers in this repo are unaffected; each has its own _request_json.

This switches to a per-request header, so the behaviour still tracks self.api_key rather than freezing it into the session at construction, and no auth header is sent at all when no key is configured.

Tests: the existing request test now asserts the header and the absence of an api_key parameter, plus two new ones - that no parameter value carries the key, and that no auth header is sent without a key. The keyless test clears the environment, since otherwise an ambient FXMACRODATA_API_KEY would be picked up and the assertion would pass for the wrong reason.

Checks: pytest tests/test_fxmacrodata_provider.py 23 passed, ruff check, ruff format --check and ty check all clean.

Disclosure: I work on FXMacroData. Thanks for building the provider - this is only about how the key is transported, nothing about the data.

🤖 Generated with Claude Code