fix(web): providers page reported a missing API key for every provider

The card tested `p.api_key` on a DTO that has never carried it, so the badge
was falsy for every provider and always read "API key missing".

The list and the new detail DTO now expose `has_api_key: bool` — the key
value itself never reaches the browser, where the edit form used to prefill
it in plain text. Since the form can no longer send the stored key back, an
empty `api_key` on update means "keep the one on file" instead of erasing it,
which is what the field's placeholder already promised.

crates/skald-core/src/llm/manager.rs

@@ -314,6 +314,7 @@ impl LlmManager {
                 provider:        p.provider.clone(),
                 base_url:        p.base_url.clone(),
                 description:     p.description.clone(),
+                has_api_key:     p.api_key.as_deref().is_some_and(|k| !k.trim().is_empty()),
                 supported_types,
             }
         }).collect()

crates/skald-core/src/llm/mod.rs

@@ -75,7 +75,8 @@ pub fn dtl_mode_from_format(fmt: &str) -> DtlMode {
 
 // ── Provider ──────────────────────────────────────────────────────────────────
 
-/// Public provider metadata (no api_key).
+/// Public provider metadata. The api_key itself never leaves the server: the UI
+/// only needs to know **whether** one is stored, so this carries a boolean.
 #[derive(Debug, Clone, serde::Serialize)]
 pub struct LlmProviderInfo {
     pub id:              i64,
@@ -84,6 +85,8 @@ pub struct LlmProviderInfo {
     pub provider:        String,
     pub base_url:        Option<String>,
     pub description:     Option<String>,
+    /// True when a non-empty api_key is stored for this provider.
+    pub has_api_key:     bool,
     /// Service types this provider supports (from ProviderRegistry at runtime).
     pub supported_types: Vec<ServiceType>,
 }