review: minor cleanups on top of secure-api-key

- node.py: mark get_api_key as @staticmethod since it doesn't use self
- node.py: clarify the IS_CHANGED comment about why env/file keys are
  intentionally excluded from the cache key
- README: warn users to clear the api_key field if they ever typed it in
  (since the value persists in the workflow JSON), and add a chmod 600
  hint for the JSON config on Linux/macOS

No behavior changes.

README.md

@@ -72,6 +72,9 @@ To keep your API key secure, use one of the following methods:
     - Set an environment variable named `LLM_KEY` on your system.
     - The node will automatically pick it up if the UI field is empty.
 
+> [!NOTE]
+> If you've ever typed your key into the **api_key** field, clear it before saving the workflow — the value is stored in the workflow JSON. On Linux/macOS, restrict the JSON config with `chmod 600 openrouter_api_key.json` so only your user can read it.
+
 ### Inputs
 
 #### Required Inputs:

node.py

@@ -33,7 +33,8 @@ class OpenRouterNode:
     def __init__(self):
         self.chat_manager = ChatSessionManager()
 
-    def get_api_key(self, api_key_ui):
+    @staticmethod
+    def get_api_key(api_key_ui):
         """
         Resolves the API key from:
         1. UI input field (if not empty)
@@ -678,8 +679,9 @@ class OpenRouterNode:
 
         # Combine all relevant inputs into a tuple for comparison
         # Use primitive types where possible for reliable hashing/comparison
-        # Note: We don't hash the resolved API key from file/env to avoid re-running 
-        # if only the hidden key changes (which is rare), but we still pass the UI value.
+        # Note: api_key here is the UI value only. Keys resolved from the LLM_KEY
+        # env var or openrouter_api_key.json are intentionally NOT part of the
+        # cache key — they're treated as user environment, not workflow inputs.
         return (api_key, system_prompt, user_message_box, model,
                 web_search, cheapest, fastest, temp_float, pdf_engine, chat_mode,
                 aspect_ratio, image_resolution, seed, tuple(image_hashes), pdf_hash, user_message_input)