Extracts the API key from the query parameter named paramName.
The parameter value is trimmed and used as-is. Returns null when the parameter is absent or blank.
Prefer header in production: query parameters commonly appear in access logs, browser history, and Referer headers.