Data provider: key from config.json/env, provider registry, drop hardcoded key

Resolves the Twelve Data API key through app_config.provider_api_key()
(env → config.json → no default) instead of a hardcoded field on
PlatformConfig. Adds data_provider.PROVIDER_REGISTRY + make_data_provider()
so signal_aggregator and the backtester build the active provider through
one seam; telegram_bot.py gets the same one-line WS-key fix now (per Task 4's
already-planned edit for that line) so the suite doesn't crash on import
between this commit and Task 4's full wiring pass.

Claude-Session: https://claude.ai/code/session_01VPNF37MP9Kuv62B1VBrZ1b

test_all.py

@@ -2725,6 +2725,47 @@ def _():
             f"example config.json must be byte-identical to defaults on {tf}"
 
 
+@test("data_provider: api key resolves env → config.json (no code default)")
+def _():
+    from data_provider import ForexDataProvider
+    app = AppConfig(provider_settings={"twelve_data": {"api_key": "json-key"}})
+    set_app_config(app)
+    try:
+        with patch.dict(os.environ, {}, clear=True):
+            dp = ForexDataProvider(PlatformConfig())
+            assert dp._api_key == "json-key"
+        with patch.dict(os.environ, {"TWELVE_DATA_API_KEY": "env-key"}):
+            dp = ForexDataProvider(PlatformConfig())
+            assert dp._api_key == "env-key"
+        set_app_config(AppConfig())        # no key anywhere
+        with patch.dict(os.environ, {}, clear=True):
+            dp = ForexDataProvider(PlatformConfig())
+            assert dp._api_key is None and dp._td is None
+    finally:
+        set_app_config(_TEST_APP)
+
+
+@test("data_provider: make_data_provider dispatches on active provider")
+def _():
+    from data_provider import ForexDataProvider, make_data_provider
+    assert isinstance(make_data_provider(PlatformConfig()), ForexDataProvider)
+    set_app_config(AppConfig(active_provider="polygon",
+                             provider_settings={"polygon": {"api_key": "k"}}))
+    try:
+        make_data_provider(PlatformConfig())
+        assert False, "unregistered provider must raise"
+    except AppConfigError as e:
+        assert "polygon" in str(e)
+    finally:
+        set_app_config(_TEST_APP)
+
+
+@test("config.py: hardcoded twelve_data_api_key field is gone")
+def _():
+    assert not hasattr(PlatformConfig(), "twelve_data_api_key"), \
+        "credentials must not live in committed source"
+
+
 # ══════════════════════════════════════════════════════════════════════
 #  SUMMARY
 # ══════════════════════════════════════════════════════════════════════