[Security] Your minimax API key was committed to this repo

Hey! Just a heads-up -- I ran a scan and it looks like an API key got committed to this repo, and it's still active.

| Detail | Value |
|--------|-------|
| Provider | minimax |
| File | `.env` |
| Source | https://github.com/decentralized-identity/universal-resolver/blob/7ffae961/.env |

### What's the risk?

The key is still live -- anyone who comes across it can use it, burning through your credits or quota.

### What to do:

1. **Revoke** the key in your minimax dashboard
2. Generate a new key and swap it in
3. Delete the key from the committed file and add `.env` to `.gitignore`
4. Check your minimax usage logs for anything suspicious
5. Scrub the key from git history with `git filter-branch` or BFG

Once you've sorted it out, just close this issue.

---

This is a free public-service scan. If it helped, you can buy me a coffee at https://ko-fi.com/cheeseup (no pressure at all).

Start by inspecting the committed `.env` at commit `7ffae961` and the repository’s `.gitignore`, then review the minimax dashboard and usage logs. Done means the exposed key is revoked and replaced, the secret is absent from the working tree and git history, and `.env` is ignored.

Written by the indexing model from the issue text.