The gap is closed as of PR #4792 : the registry now declares an openaiApiKey secret setting, and createInProcessEngine reads it through apiKeyFor(secrets, settings.defs()) on every turn.
It is interesting how payment choice affects both convenience and discipline, especially when prepaid options help keep spending separate.