feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths_get.json

@@ -0,0 +1,154 @@
+{
+  "/get/default_team_settings": {
+    "get": {
+      "tags": [
+        "SSO Settings"
+      ],
+      "summary": "Get Default Team Settings",
+      "description": "Get all SSO settings from the litellm_settings configuration.\nReturns a structured object with values and descriptions for UI display.",
+      "operationId": "get_default_team_settings_get_default_team_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/DefaultTeamSettingsResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  },
+  "/get/internal_user_settings": {
+    "get": {
+      "tags": [
+        "SSO Settings"
+      ],
+      "summary": "Get Internal User Settings",
+      "description": "Get all SSO settings from the litellm_settings configuration.\nReturns a structured object with values and descriptions for UI display.",
+      "operationId": "get_internal_user_settings_get_internal_user_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/InternalUserSettingsResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  },
+  "/get/mcp_semantic_filter_settings": {
+    "get": {
+      "tags": [
+        "Settings"
+      ],
+      "summary": "Get Mcp Semantic Filter Settings",
+      "description": "Get MCP semantic filter configuration.\nReturns current settings for semantic tool filtering.",
+      "operationId": "get_mcp_semantic_filter_settings_get_mcp_semantic_filter_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/MCPSemanticFilterSettingsResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  },
+  "/get/sso_settings": {
+    "get": {
+      "tags": [
+        "SSO Settings"
+      ],
+      "summary": "Get Sso Settings",
+      "description": "Get all SSO configuration settings from the dedicated SSO table.\nReturns a structured object with values and descriptions for UI display.",
+      "operationId": "get_sso_settings_get_sso_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/SSOSettingsResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  },
+  "/get/ui_settings": {
+    "get": {
+      "tags": [
+        "UI Settings"
+      ],
+      "summary": "Get Ui Settings",
+      "description": "Get UI-specific configuration flags.\nAll authenticated users can fetch these settings for client-side behavior.",
+      "operationId": "get_ui_settings_get_ui_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UISettingsResponse"
+              }
+            }
+          }
+        }
+      }
+    }
+  },
+  "/get/ui_theme_settings": {
+    "get": {
+      "tags": [
+        "UI Theme Settings"
+      ],
+      "summary": "Get Ui Theme Settings",
+      "description": "Get UI theme configuration from the litellm_settings.\nReturns current logo settings for UI customization.\n\nNote: This endpoint is public (no authentication required) so all users can see custom branding.\nOnly the /update/ui_theme_settings endpoint requires authentication for admins to change settings.",
+      "operationId": "get_ui_theme_settings_get_ui_theme_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/UIThemeSettingsResponse"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}