feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths_router.json

@@ -0,0 +1,56 @@
+{
+  "/router/fields": {
+    "get": {
+      "tags": [
+        "Router Settings"
+      ],
+      "summary": "Get Router Fields",
+      "description": "Get router settings field definitions without values.\n\nReturns only the field metadata (type, description, default, options) without\npopulating field_value. This is useful for UI components that need to know\nwhat fields to render, but will get the actual values from a different endpoint.\n\nReturns:\n- fields: List of all configurable router settings with their metadata (type, description, default, options)\n          The routing_strategy field includes available options extracted from the Router class\n          Note: field_value will be None for all fields\n- routing_strategy_descriptions: Descriptions for each routing strategy option",
+      "operationId": "get_router_fields_router_fields_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RouterFieldsResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  },
+  "/router/settings": {
+    "get": {
+      "tags": [
+        "Router Settings"
+      ],
+      "summary": "Get Router Settings",
+      "description": "Get router configuration and available settings.\n\nReturns:\n- fields: List of all configurable router settings with their metadata (type, description, default, options)\n          The routing_strategy field includes available options extracted from the Router class\n- current_values: Current values of router settings from config",
+      "operationId": "get_router_settings_router_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RouterSettingsResponse"
+              }
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  }
+}