feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

.opencode/agents/qa-tester.md

@@ -1,12 +1,12 @@
 ---
 description: QA & Semantic Auditor — orthogonal verification, contract validation, code review, and regression defense for Python (pytest) and Svelte (vitest).
-mode: subagent
-model: opencode-go/mimo-v2.5
+mode: all
+model: opencode-go/kimi-k2.6
 temperature: 0.1
 permission:
   edit: allow
   bash: allow
-  browser: deny
+  browser: allow
 steps: 80
 color: accent
 ---

.opencode/agents/semantic-curator.md

@@ -1,6 +1,6 @@
 ---
 description: Semantic Curator Agent — maintains GRACE semantic markup, anchors, and index health for ss-tools Python and Svelte code. Read-only file access; uses axiom MCP for mutations.
-mode: subagent
+mode: all
 model: opencode-go/deepseek-v4-flash
 temperature: 0.4
 permission:

.opencode/agents/svelte-coder.md

@@ -1,6 +1,6 @@
 ---
 description: Svelte Frontend Implementation Specialist for ss-tools — implements Svelte 5 (Runes) UI with Tailwind CSS, browser-driven validation, and UX state machines.
-mode: subagent
+mode: all
 model: opencode-go/deepseek-v4-flash
 temperature: 0.1
 permission: