feat: accept DISCOURSE_KEY as env alias for the API key

NewFromEnv now falls back to DISCOURSE_KEY when DISCOURSE_API_KEY
is unset (the explicit name still wins), matching the shorter
DISCOURSE_URL/DISCOURSE_KEY convention used across the MOPAC fleet
scripts. Behavioral test proves both the alias and the precedence
against the fake server.

Part of Redmine 507 (Discourse Go client).

discourse_test.go

@@ -341,6 +341,33 @@ func TestNewRejectsBadInput(t *testing.T) {
 	}
 }
 
+func TestNewFromEnvKeyAlias(t *testing.T) {
+	f := newFake(t)
+	// alias alone works: DISCOURSE_KEY is accepted for the API key
+	t.Setenv("DISCOURSE_URL", f.srv.URL)
+	t.Setenv("DISCOURSE_API_USERNAME", "system")
+	t.Setenv("DISCOURSE_API_KEY", "")
+	t.Setenv("DISCOURSE_KEY", testKey)
+	c, err := NewFromEnv()
+	if err != nil {
+		t.Fatalf("NewFromEnv with DISCOURSE_KEY: %v", err)
+	}
+	if _, err := c.CurrentUser(context.Background()); err != nil {
+		t.Fatalf("alias key must authenticate against the fake: %v", err)
+	}
+	// explicit DISCOURSE_API_KEY wins over the alias (fake 403s any other key)
+	t.Setenv("DISCOURSE_API_KEY", "not-the-key")
+	t.Setenv("DISCOURSE_KEY", testKey)
+	c, err = NewFromEnv()
+	if err != nil {
+		t.Fatalf("NewFromEnv: %v", err)
+	}
+	_, err = c.CurrentUser(context.Background())
+	if !errors.Is(err, ErrForbidden) {
+		t.Fatalf("primary key must take precedence over the alias, got %v", err)
+	}
+}
+
 func TestCurrentUser(t *testing.T) {
 	f := newFake(t)
 	c := testClient(t, f)