feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths_cost.json

@@ -0,0 +1,49 @@
+{
+  "/cost/estimate": {
+    "post": {
+      "tags": [
+        "Cost Tracking"
+      ],
+      "summary": "Estimate Cost",
+      "description": "Estimate cost for a given model and token counts.\n\nThis endpoint uses the same cost calculation logic as actual requests,\nincluding any configured margins and discounts.\n\nParameters:\n- model: Model name (e.g., \"gpt-4\", \"claude-3-opus\")\n- input_tokens: Expected input tokens per request\n- output_tokens: Expected output tokens per request\n- num_requests_per_day: Number of requests per day (optional)\n- num_requests_per_month: Number of requests per month (optional)\n\nReturns cost breakdown including:\n- Per-request costs (input, output, margin)\n- Daily costs (if num_requests_per_day provided)\n- Monthly costs (if num_requests_per_month provided)\n\nExample:\n```json\n{\n    \"model\": \"gpt-4\",\n    \"input_tokens\": 1000,\n    \"output_tokens\": 500,\n    \"num_requests_per_day\": 100,\n    \"num_requests_per_month\": 3000\n}\n```",
+      "operationId": "estimate_cost_cost_estimate_post",
+      "requestBody": {
+        "content": {
+          "application/json": {
+            "schema": {
+              "$ref": "#/components/schemas/CostEstimateRequest"
+            }
+          }
+        },
+        "required": true
+      },
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CostEstimateResponse"
+              }
+            }
+          }
+        },
+        "422": {
+          "description": "Validation Error",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/HTTPValidationError"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  }
+}