fix(web): providers page reported a missing API key for every provider

The card tested `p.api_key` on a DTO that has never carried it, so the badge
was falsy for every provider and always read "API key missing".

The list and the new detail DTO now expose `has_api_key: bool` — the key
value itself never reaches the browser, where the edit form used to prefill
it in plain text. Since the form can no longer send the stored key back, an
empty `api_key` on update means "keep the one on file" instead of erasing it,
which is what the field's placeholder already promised.

web/components/llm-providers.js

@@ -98,14 +98,15 @@ export class LlmProvidersPage extends LightElement {
       const res = await fetch(`/api/llm/providers/${provider.id}`);
       if (!res.ok) throw new Error(`HTTP ${res.status}`);
       const record = await res.json();
+      // The server never sends the stored key back — an empty box means "keep it".
       this._form = {
         name:        record.name,
         type:        record.type,
-        api_key:     record.api_key  ?? '',
+        api_key:     '',
         base_url:    record.base_url ?? '',
         description: record.description ?? '',
       };
-      this._modal = { mode: 'edit', id: record.id };
+      this._modal = { mode: 'edit', id: record.id, hasKey: Boolean(record.has_api_key) };
     } catch (e) {
       this._error = e.message;
     }
@@ -172,7 +173,7 @@ export class LlmProvidersPage extends LightElement {
     const icon     = meta.icon;
     const label    = meta.display_name;
     const count    = this._modelCounts[String(p.id)];
-    const hasKey   = Boolean(p.api_key);
+    const hasKey   = Boolean(p.has_api_key);
     const needsUrl = meta.fields.some(f => f.key === 'base_url');
 
     return html`
@@ -268,7 +269,7 @@ export class LlmProvidersPage extends LightElement {
                 <label class="form-label fw-semibold" style="font-size:0.82rem">${t('providers.modal.api_key')}</label>
                 <input type="password" class="form-control form-control-sm" .value=${f.api_key}
                   autocomplete="new-password"
-                  placeholder=${isEdit ? t('providers.modal.api_key_ph') : ''}
+                  placeholder=${isEdit && this._modal?.hasKey ? t('providers.modal.api_key_ph') : ''}
                   @input=${(e) => this._setField('api_key', e.target.value)} />
               </div>
             ` : ''}