feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths__v1_realtime.json

@@ -0,0 +1,88 @@
+{
+  "/v1/realtime": {
+    "get": {
+      "summary": "WebSocket: realtime_websocket_endpoint",
+      "description": "WebSocket connection endpoint",
+      "operationId": "websocket_realtime_websocket_endpoint",
+      "parameters": [
+        {
+          "name": "model",
+          "in": "query",
+          "required": true,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "intent",
+          "in": "query",
+          "required": false,
+          "schema": {
+            "type": "string"
+          }
+        },
+        {
+          "name": "guardrails",
+          "in": "query",
+          "required": false,
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "responses": {
+        "101": {
+          "description": "WebSocket Protocol Switched"
+        }
+      },
+      "tags": [
+        "WebSocket"
+      ]
+    }
+  },
+  "/v1/realtime/calls": {
+    "post": {
+      "tags": [
+        "realtime"
+      ],
+      "summary": "Proxy Realtime Calls",
+      "operationId": "proxy_realtime_calls_v1_realtime_calls_post",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {}
+            }
+          }
+        }
+      }
+    }
+  },
+  "/v1/realtime/client_secrets": {
+    "post": {
+      "tags": [
+        "realtime"
+      ],
+      "summary": "Create Realtime Client Secret",
+      "operationId": "create_realtime_client_secret_v1_realtime_client_secrets_post",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RealtimeClientSecretResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  }
+}