feat(settings): LLM config API with AES-GCM sealed key, masked reads

- Add GET/PUT /api/settings for encrypted LLM configuration
- SettingsResponse with masked key display
- SettingsUpdate validation with optional fields
- Defaults: llmBaseUrl "https://openrouter.ai/api/v1", llmModel "anthropic/claude-sonnet-4.5"
- Encrypted storage with AES-256-GCM for llm_key
- getSetting() export for future route groups
- Comprehensive test coverage: defaults, updates, masking, encryption at rest, validation

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/src/app.ts

@@ -2,6 +2,7 @@ import { Hono } from "hono";
 import { getCookie } from "hono/cookie";
 import type { Db } from "./db";
 import { authRoutes, isAuthenticated } from "./routes/auth";
+import { settingsRoutes } from "./routes/settings";
 
 export type Deps = { db: Db; key: Buffer };
 const PUBLIC = new Set(["/api/health", "/api/me", "/api/setup", "/api/login"]);
@@ -17,7 +18,7 @@ export function createApp(deps: Deps) {
     return next();
   });
   app.route("/api", authRoutes({ db: deps.db }));
-  // Later route groups (settings, connectors, chat) mount here.
-  app.get("/api/settings", (c) => c.json({ error: "not implemented" }, 501)); // replaced in Task 5
+  app.route("/api", settingsRoutes(deps));
+  // Later route groups (connectors, chat) mount here.
   return app;
 }