feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/litellm/chunks_paths/paths_settings.json

@@ -0,0 +1,27 @@
+{
+  "/settings": {
+    "get": {
+      "tags": [
+        "health"
+      ],
+      "summary": "Active Callbacks",
+      "description": "Returns a list of litellm level settings\n\nThis is useful for debugging and ensuring the proxy server is configured correctly.\n\nResponse schema:\n```\n{\n    \"alerting\": _alerting,\n    \"litellm.callbacks\": litellm_callbacks,\n    \"litellm.input_callback\": litellm_input_callbacks,\n    \"litellm.failure_callback\": litellm_failure_callbacks,\n    \"litellm.success_callback\": litellm_success_callbacks,\n    \"litellm._async_success_callback\": litellm_async_success_callbacks,\n    \"litellm._async_failure_callback\": litellm_async_failure_callbacks,\n    \"litellm._async_input_callback\": litellm_async_input_callbacks,\n    \"all_litellm_callbacks\": all_litellm_callbacks,\n    \"num_callbacks\": len(all_litellm_callbacks),\n    \"num_alerting\": _num_alerting,\n    \"litellm.request_timeout\": litellm.request_timeout,\n}\n```",
+      "operationId": "active_callbacks_settings_get",
+      "responses": {
+        "200": {
+          "description": "Successful Response",
+          "content": {
+            "application/json": {
+              "schema": {}
+            }
+          }
+        }
+      },
+      "security": [
+        {
+          "APIKeyHeader": []
+        }
+      ]
+    }
+  }
+}