feat(llm): mask API keys in UI responses and prevent masked-key leakage in fetch/test/save payloads

- Add mask_api_key() and is_masked_or_placeholder() to llm_provider service
- Return masked keys in all provider CRUD endpoints
- Reject masked/placeholder keys in fetch_models and test_provider_config
- Show masked key with Change button in ProviderConfig.svelte edit form
- Exclude masked keys from fetch-models, test, and submit payloads on frontend
- Update semantics-core skill with clarified complexity tier rules
- Switch agent modes from subagent to all

docs/openapi/superset/paths/async_event.json

@@ -0,0 +1,78 @@
+{
+  "/api/v1/async_event/": {
+    "get": {
+      "description": "Reads off of the Redis events stream, using the user's JWT token and optional query params for last event received.",
+      "parameters": [
+        {
+          "description": "Last ID received by the client",
+          "in": "query",
+          "name": "last_id",
+          "schema": {
+            "type": "string"
+          }
+        }
+      ],
+      "responses": {
+        "200": {
+          "content": {
+            "application/json": {
+              "schema": {
+                "properties": {
+                  "result": {
+                    "items": {
+                      "properties": {
+                        "channel_id": {
+                          "type": "string"
+                        },
+                        "errors": {
+                          "items": {
+                            "type": "object"
+                          },
+                          "type": "array"
+                        },
+                        "id": {
+                          "type": "string"
+                        },
+                        "job_id": {
+                          "type": "string"
+                        },
+                        "result_url": {
+                          "type": "string"
+                        },
+                        "status": {
+                          "type": "string"
+                        },
+                        "user_id": {
+                          "type": "integer"
+                        }
+                      },
+                      "type": "object"
+                    },
+                    "type": "array"
+                  }
+                },
+                "type": "object"
+              }
+            }
+          },
+          "description": "Async event results"
+        },
+        "401": {
+          "$ref": "#/components/responses/401"
+        },
+        "500": {
+          "$ref": "#/components/responses/500"
+        }
+      },
+      "security": [
+        {
+          "jwt": []
+        }
+      ],
+      "summary": "Read off of the Redis events stream",
+      "tags": [
+        "AsyncEventsRestApi"
+      ]
+    }
+  }
+}\n