feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths_rag.json

@@ -0,0 +1,52 @@
+{
+  "/rag/ingest": {
+    "post": {
+      "tags": [
+        "rag"
+      ],
+      "summary": "Rag Ingest",
+      "description": "RAG Ingest endpoint - all-in-one document ingestion pipeline.\n\nSupports form upload (for files) or JSON body (for URLs).\n\n## Form upload (for files):\n```bash\ncurl -X POST \"http://localhost:4000/v1/rag/ingest\" \\\n    -H \"Authorization: Bearer sk-1234\" \\\n    -F file=\"@document.pdf\" \\\n    -F 'ingest_options={\"vector_store\": {\"custom_llm_provider\": \"openai\"}}'\n```\n\n## JSON body (for URLs):\n```bash\ncurl -X POST \"http://localhost:4000/v1/rag/ingest\" \\\n    -H \"Authorization: Bearer sk-1234\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"file_url\": \"https://example.com/document.pdf\",\n        \"ingest_options\": {\"vector_store\": {\"custom_llm_provider\": \"openai\"}}\n    }'\n```\n\n## Bedrock:\n```bash\ncurl -X POST \"http://localhost:4000/v1/rag/ingest\" \\\n    -H \"Authorization: Bearer sk-1234\" \\\n    -F file=\"@document.pdf\" \\\n    -F 'ingest_options={\"vector_store\": {\"custom_llm_provider\": \"bedrock\"}}'\n```",
+      "operationId": "rag_ingest_rag_ingest_post",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {}
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  },
+  "/rag/query": {
+    "post": {
+      "tags": [
+        "rag"
+      ],
+      "summary": "Rag Query",
+      "description": "RAG Query endpoint - search vector store, optionally rerank, and generate LLM response.\n\nThis endpoint:\n1. Extracts the query from the last user message\n2. Searches the vector store for relevant context\n3. Optionally reranks the results\n4. Generates an LLM response with the retrieved context\n\n## Example Request:\n```bash\ncurl -X POST \"http://localhost:4000/v1/rag/query\" \\\n    -H \"Authorization: Bearer sk-1234\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"model\": \"gpt-4o-mini\",\n        \"messages\": [{\"role\": \"user\", \"content\": \"What is LiteLLM?\"}],\n        \"retrieval_config\": {\n            \"vector_store_id\": \"vs_abc123\",\n            \"custom_llm_provider\": \"openai\",\n            \"top_k\": 5\n        }\n    }'\n```\n\n## With Reranking:\n```bash\ncurl -X POST \"http://localhost:4000/v1/rag/query\" \\\n    -H \"Authorization: Bearer sk-1234\" \\\n    -H \"Content-Type: application/json\" \\\n    -d '{\n        \"model\": \"gpt-4o-mini\",\n        \"messages\": [{\"role\": \"user\", \"content\": \"What is LiteLLM?\"}],\n        \"retrieval_config\": {\n            \"vector_store_id\": \"vs_abc123\",\n            \"custom_llm_provider\": \"openai\",\n            \"top_k\": 10\n        },\n        \"rerank\": {\n            \"enabled\": true,\n            \"model\": \"cohere/rerank-english-v3.0\",\n            \"top_n\": 3\n        }\n    }'\n```",
+      "operationId": "rag_query_rag_query_post",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {}
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  }
+}