fix: Create default TLS config is API key is exposed

Author: roxblnfk

src/Common/EnvConfig/Client/ConfigProfile.php

@@ -49,6 +49,7 @@ final class ConfigProfile
      * @var array<non-empty-lowercase-string, list<string>>
      */
     public readonly array $grpcMeta;
+    public readonly ?ConfigTls $tlsConfig;
 
     /**
      * Construct a new configuration profile.
@@ -69,14 +70,16 @@ public function __construct(
         ?string $address,
         ?string $namespace,
         null|string|\Stringable $apiKey,
-        public readonly ?ConfigTls $tlsConfig = null,
+        ?ConfigTls $tlsConfig = null,
         array $grpcMeta = [],
         public readonly ?ConfigCodec $codecConfig = null,
     ) {
         // Normalize empty strings to null
         $this->address = $address === '' ? null : $address;
         $this->namespace = $namespace === '' ? null : $namespace;
         $this->apiKey = $apiKey === '' ? null : $apiKey;
+        // If TLS config not provided, create default if API key is set
+        $this->tlsConfig = $tlsConfig ?? ($this->apiKey === null ? null : new ConfigTls());
 
         // Normalize gRPC metadata keys to lowercase per gRPC spec
         $meta = [];