Add GUI settings panel for API keys, model presets, and embedding model

- Add a password-protected /api/settings endpoint (HTTP Basic auth,
  backend/app/core/auth.py) backed by a DB-stored allowlist of
  connection settings (OPENAI_API_KEY, ANTHROPIC_API_KEY, AWS creds,
  OLLAMA_API_BASE, TAVILY_API_KEY, LOCAL_KB_EMBEDDING_MODEL). Saved
  values override .env and apply immediately via os.environ, so
  Lightsail deployments no longer need SSH + `.env` edits to rotate
  keys. Values are always returned masked to the frontend.
- Replace ModelSelector.vue's hardcoded model list with a DB-backed
  /api/models CRUD API (read is public, writes reuse the settings
  password) so the chat model dropdown can be edited from the GUI;
  seed it once with the previous hardcoded presets on first boot.
- Fix local_knowledge.py reading LOCAL_KB_EMBEDDING_MODEL once at
  import time instead of per-call, which would have silently ignored
  GUI/DB overrides for the embedding model.
- Add SettingsPanel.vue (API keys + model management UI) and document
  the new SETTINGS_PASSWORD env var in .env.example and the Lightsail
  deploy guide.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

frontend/src/stores/settings.ts

@@ -0,0 +1,138 @@
+import { defineStore } from 'pinia'
+import { ref } from 'vue'
+import {
+  fetchSettings,
+  saveSettings,
+  clearSetting,
+  fetchModelPresets,
+  createModelPreset,
+  updateModelPreset,
+  deleteModelPreset,
+  type SettingEntry,
+  type ModelPreset,
+} from '../api/client'
+
+const STORAGE_KEY = 'playchat_settings_password'
+
+export const useSettingsStore = defineStore('settings', () => {
+  const password = ref(sessionStorage.getItem(STORAGE_KEY) ?? '')
+  const unlocked = ref(false)
+  const entries = ref<SettingEntry[]>([])
+  const modelPresets = ref<ModelPreset[]>([])
+  const loading = ref(false)
+  const error = ref<string | null>(null)
+
+  async function unlock(candidatePassword: string): Promise<boolean> {
+    loading.value = true
+    error.value = null
+    try {
+      entries.value = await fetchSettings(candidatePassword)
+      password.value = candidatePassword
+      sessionStorage.setItem(STORAGE_KEY, candidatePassword)
+      unlocked.value = true
+      return true
+    } catch (e) {
+      unlocked.value = false
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+      return false
+    } finally {
+      loading.value = false
+    }
+  }
+
+  /** ページ再読み込み時などに、保存済みパスワードで自動的に再認証を試みる。 */
+  async function tryAutoUnlock(): Promise<void> {
+    if (!password.value || unlocked.value) return
+    await unlock(password.value)
+  }
+
+  async function save(values: Record<string, string>): Promise<boolean> {
+    loading.value = true
+    error.value = null
+    try {
+      entries.value = await saveSettings(values, password.value)
+      return true
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+      return false
+    } finally {
+      loading.value = false
+    }
+  }
+
+  async function clear(key: string): Promise<void> {
+    error.value = null
+    try {
+      entries.value = await clearSetting(key, password.value)
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+    }
+  }
+
+  function lock() {
+    unlocked.value = false
+    password.value = ''
+    sessionStorage.removeItem(STORAGE_KEY)
+  }
+
+  /** モデル一覧は認証不要で誰でも取得できる（ModelSelectorから直接呼ばれる想定）。 */
+  async function loadModelPresets(): Promise<void> {
+    try {
+      modelPresets.value = await fetchModelPresets()
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+    }
+  }
+
+  async function addModelPreset(label: string, value: string): Promise<boolean> {
+    error.value = null
+    try {
+      const created = await createModelPreset(label, value, password.value)
+      modelPresets.value = [...modelPresets.value, created]
+      return true
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+      return false
+    }
+  }
+
+  async function editModelPreset(id: number, label: string, value: string): Promise<boolean> {
+    error.value = null
+    try {
+      const updated = await updateModelPreset(id, label, value, password.value)
+      modelPresets.value = modelPresets.value.map((p) => (p.id === id ? updated : p))
+      return true
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+      return false
+    }
+  }
+
+  async function removeModelPreset(id: number): Promise<void> {
+    error.value = null
+    try {
+      await deleteModelPreset(id, password.value)
+      modelPresets.value = modelPresets.value.filter((p) => p.id !== id)
+    } catch (e) {
+      error.value = e instanceof Error ? e.message : 'エラーが発生しました'
+    }
+  }
+
+  return {
+    password,
+    unlocked,
+    entries,
+    modelPresets,
+    loading,
+    error,
+    unlock,
+    tryAutoUnlock,
+    save,
+    clear,
+    lock,
+    loadModelPresets,
+    addModelPreset,
+    editModelPreset,
+    removeModelPreset,
+  }
+})