ryanflannery fix: prevent secret exposure in settings API responses

[ryanvflannery]

Summary

Redacts sensitive settings values returned by the settings API.

Changes

• Mask API keys returned from settings responses (Anthropic, OpenAI, Google, OpenRouter, subscription tokens, etc.)
• Remove openswarm_bearer_token from settings responses
• Preserve existing stored secrets when masked values are submitted through settings updates
• Continue displaying masked values in the UI so users can see when a key is configured

Testing

• Verified masked values are returned by GET /api/settings
• Verified settings updates continue working through PUT /api/settings
• Verified masked values do not overwrite stored secrets
• Verified values persist correctly in settings.json
• Verified OpenSwarm UI loads and displays masked secrets correctly

[ciregenz]

Settings secret redaction has since shipped (backend/apps/settings/redaction.py), resolving the exposure this targeted (#46). Closing as superseded, thank you for the security fix.

[ciregenz]

Reopening, I closed this in error. I'd assumed it was superseded by backend/apps/settings/redaction.py, but that only redacts the SettingsRead MCP tool; the actual HTTP endpoint GET /api/settings (backend/apps/settings/settings.py:116) still returns the full model_dump() with every provider key plus the bearer token, unredacted. So this PR's mask-on-read / preserve-on-masked-write fix is still needed (see the PUT-clobber trap noted in the issue). Apologies for the noise.