Set the OpenAI-compatible endpoint from the settings panel

Pointing OPENAI_BASE_URL at a local llama-server or Ollama sends every gpt-*
call there instead of to OpenAI, and litellm reports that as a bare
"Connection Error" — which reads like a network problem even though the host
can reach api.openai.com fine. Deploying a .env that still carries the local
endpoint reproduces it on the server, with nothing in the message naming the
culprit.

Add OPENAI_BASE_URL and OPENAI_API_BASE to the settings allowlist so the
endpoint can be corrected without editing .env and recreating the container.
Both are listed because litellm reads OPENAI_API_BASE while the OpenAI SDK
reads OPENAI_BASE_URL, so fixing one can leave the other in effect. Neither is
a secret, so the panel shows the current value.

No cache invalidation is needed alongside this: litellm keys its client cache
on the endpoint, so a changed value takes effect on the next call.

Document the trap where it will be read — a commented template in .env.example
and a note in the Lightsail deploy guide about carrying a local .env over.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/app/core/settings_store.py

@@ -7,6 +7,11 @@ from app.db.models import AppSetting
 # GUIから編集可能な環境変数の許可リスト。ここに無いキーは save()/clear() で拒否する。
 CONFIGURABLE_KEYS = [
     "OPENAI_API_KEY",
+    # OpenAI 互換エンドポイント。ローカルの llama-server / Ollama を向けたまま忘れると、
+    # OpenAI のモデルを選んでも接続先がそちらのままになる（litellm は OPENAI_API_BASE、
+    # OpenAI SDK は OPENAI_BASE_URL を見るので両方を出しておく）。
+    "OPENAI_BASE_URL",
+    "OPENAI_API_BASE",
     "ANTHROPIC_API_KEY",
     "AWS_ACCESS_KEY_ID",
     "AWS_SECRET_ACCESS_KEY",
@@ -22,6 +27,8 @@ CONFIGURABLE_KEYS = [
 # 秘匿情報ではないキー。値をマスクせずそのまま返し、GUIでも通常のテキスト入力として扱う。
 # モデル名やURLは「今どれが効いているか」が見えないと設定しづらいため。
 NON_SECRET_KEYS = {
+    "OPENAI_BASE_URL",
+    "OPENAI_API_BASE",
     "AWS_REGION_NAME",
     "OLLAMA_API_BASE",
     "LOCAL_KB_EMBEDDING_MODEL",