Add GUI settings panel for API keys, model presets, and embedding model

- Add a password-protected /api/settings endpoint (HTTP Basic auth,
  backend/app/core/auth.py) backed by a DB-stored allowlist of
  connection settings (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS creds,
  OLLAMA_API_BASE, TAVILY_API_KEY, LOCAL_KB_EMBEDDING_MODEL). Saved
  values override .env and apply immediately via os.environ, so
  Lightsail deployments no longer need SSH + `.env` edits to rotate
  keys. Values are always returned masked to the frontend.
- Replace ModelSelector.vue's hardcoded model list with a DB-backed
  /api/models CRUD API (read is public, writes reuse the settings
  password) so the chat model dropdown can be edited from the GUI;
  seed it once with the previous hardcoded presets on first boot.
- Fix local_knowledge.py reading LOCAL_KB_EMBEDDING_MODEL once at
  import time instead of per-call, which would have silently ignored
  GUI/DB overrides for the embedding model.
- Add SettingsPanel.vue (API keys + model management UI) and document
  the new SETTINGS_PASSWORD env var in .env.example and the Lightsail
  deploy guide.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/app/api/models.py

@@ -0,0 +1,67 @@
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.orm import Session as DBSession
+
+from app.core.auth import require_settings_password
+from app.db.database import get_db
+from app.db.models import ModelPreset
+
+router = APIRouter(prefix="/api/models", tags=["models"])
+
+
+class ModelPresetResponse(BaseModel):
+    id: int
+    label: str
+    value: str
+
+    class Config:
+        from_attributes = True
+
+
+class ModelPresetRequest(BaseModel):
+    label: str
+    value: str
+
+
+@router.get("", response_model=list[ModelPresetResponse])
+def list_model_presets(db: DBSession = Depends(get_db)):
+    """モデル選択プルダウンの表示に使うため認証不要（誰でも読める）。"""
+    return db.query(ModelPreset).order_by(ModelPreset.id).all()
+
+
+@router.post("", response_model=ModelPresetResponse, dependencies=[Depends(require_settings_password)])
+def create_model_preset(req: ModelPresetRequest, db: DBSession = Depends(get_db)):
+    preset = ModelPreset(label=req.label, value=req.value)
+    db.add(preset)
+    try:
+        db.commit()
+    except IntegrityError as e:
+        db.rollback()
+        raise HTTPException(status_code=400, detail=f"モデル文字列が重複しています: {req.value}") from e
+    db.refresh(preset)
+    return preset
+
+
+@router.put("/{preset_id}", response_model=ModelPresetResponse, dependencies=[Depends(require_settings_password)])
+def update_model_preset(preset_id: int, req: ModelPresetRequest, db: DBSession = Depends(get_db)):
+    preset = db.get(ModelPreset, preset_id)
+    if not preset:
+        raise HTTPException(status_code=404, detail="Model preset not found")
+    preset.label = req.label
+    preset.value = req.value
+    try:
+        db.commit()
+    except IntegrityError as e:
+        db.rollback()
+        raise HTTPException(status_code=400, detail=f"モデル文字列が重複しています: {req.value}") from e
+    db.refresh(preset)
+    return preset
+
+
+@router.delete("/{preset_id}", status_code=204, dependencies=[Depends(require_settings_password)])
+def delete_model_preset(preset_id: int, db: DBSession = Depends(get_db)):
+    preset = db.get(ModelPreset, preset_id)
+    if preset:
+        db.delete(preset)
+        db.commit()

backend/app/api/settings.py

@@ -0,0 +1,46 @@
+from fastapi import APIRouter, Depends, HTTPException
+from pydantic import BaseModel
+from sqlalchemy.orm import Session as DBSession
+
+from app.core import settings_store
+from app.core.auth import require_settings_password
+from app.db.database import get_db
+
+router = APIRouter(prefix="/api/settings", tags=["settings"], dependencies=[Depends(require_settings_password)])
+
+
+class SettingEntry(BaseModel):
+    key: str
+    is_set: bool
+    masked: str | None
+    overridden: bool
+
+
+class SaveSettingsRequest(BaseModel):
+    values: dict[str, str]
+
+
+@router.get("", response_model=list[SettingEntry])
+def list_settings(db: DBSession = Depends(get_db)):
+    return settings_store.list_masked(db)
+
+
+@router.put("", response_model=list[SettingEntry])
+def save_settings(req: SaveSettingsRequest, db: DBSession = Depends(get_db)):
+    try:
+        for key, value in req.values.items():
+            if not value:
+                continue  # 空欄は「変更なし」として無視する
+            settings_store.save(db, key, value)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+    return settings_store.list_masked(db)
+
+
+@router.delete("/{key}", response_model=list[SettingEntry])
+def clear_setting(key: str, db: DBSession = Depends(get_db)):
+    try:
+        settings_store.clear(db, key)
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+    return settings_store.list_masked(db)