ExchangeRate-API authentication can keep keys out of request URLs

For the ExchangeRate-API entry, use the authentication pattern documented for the chosen service rather than mixing it with a similarly named provider.

ExchangeRate-API's guide allows a Bearer header instead of a key embedded in the URL, with the URL's key segment removed accordingly. URL-based credentials can otherwise be copied into ordinary request logs and diagnostics.

Test the resulting path and header together, and redact credentials regardless of where they are carried. Keep the separate no-key service distinct from the authenticated endpoint.