fix(web): providers page reported a missing API key for every provider

The card tested `p.api_key` on a DTO that has never carried it, so the badge
was falsy for every provider and always read "API key missing".

The list and the new detail DTO now expose `has_api_key: bool` — the key
value itself never reaches the browser, where the edit form used to prefill
it in plain text. Since the form can no longer send the stored key back, an
empty `api_key` on update means "keep the one on file" instead of erasing it,
which is what the field's placeholder already promised.

CHANGELOG.md

@@ -8,6 +8,18 @@ release PR may merge — and a section is closed at the commit that bumps it.
 
 ## [Unreleased]
 
+### Fixed
+
+- The **Providers** page said *API key missing* on every provider, including the ones
+  with a perfectly good key. It now reports the real state. Editing a provider no longer
+  shows the saved key in the form either — leave the field blank and the existing key is
+  kept, type a new one to replace it.
+
+### Security
+
+- An LLM provider's API key is never sent to the browser any more: the provider list and
+  the edit form receive only whether a key is stored, not its value.
+
 ## [0.3.0] - 2026-08-24
 
 ### Added