feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths_provider.json

@@ -0,0 +1,21 @@
+{
+  "/provider/budgets": {
+    "get": {
+      "summary": "Provider Budgets",
+      "description": "Provider Budget Routing - Get Budget, Spend Details https://docs.litellm.ai/docs/proxy/provider_budget_routing\n\nUse this endpoint to check current budget, spend and budget reset time for a provider\n\nExample Request\n\n```bash\ncurl -X GET http://localhost:4000/provider/budgets     -H \"Content-Type: application/json\"     -H \"Authorization: Bearer sk-1234\"\n```\n\nExample Response\n\n```json\n{\n    \"providers\": {\n        \"openai\": {\n            \"budget_limit\": 1e-12,\n            \"time_period\": \"1d\",\n            \"spend\": 0.0,\n            \"budget_reset_at\": null\n        },\n        \"azure\": {\n            \"budget_limit\": 100.0,\n            \"time_period\": \"1d\",\n            \"spend\": 0.0,\n            \"budget_reset_at\": null\n        },\n        \"anthropic\": {\n            \"budget_limit\": 100.0,\n            \"time_period\": \"10d\",\n            \"spend\": 0.0,\n            \"budget_reset_at\": null\n        },\n        \"vertex_ai\": {\n            \"budget_limit\": 100.0,\n            \"time_period\": \"12d\",\n            \"spend\": 0.0,\n            \"budget_reset_at\": null\n        }\n    }\n}\n```",
+      "operationId": "provider_budgets_provider_budgets_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/ProviderBudgetResponse"
+              }
+            }
+          }
+        }
+      }
+    }
+  }
+}