Stop leaking the Gemini API key through /gemini_key

The settings endpoint returned the raw key to any caller, and the
frontend used that response to pre-fill the input field, which also
meant saving with an untouched field would silently resubmit the
plaintext key. /gemini_key now reports only whether a key is set and
a masked preview; the UI shows that as a placeholder and only updates
the stored key when the field is actually filled in.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

static/index.html

@@ -3171,8 +3171,11 @@
 
     function openGeminiKeySettings() {
         $('#geminiKeyAlert').html('');
+        $('#gemini_key_input').val('');
         $.get('/gemini_key', function(data) {
-            $('#gemini_key_input').val(data.gemini_key || '');
+            $('#gemini_key_input').attr('placeholder', data.configured
+                ? ('Clé enregistrée (' + data.masked_key + ') — laisser vide pour ne pas changer')
+                : 'AIza...');
         });
         var show = localStorage.getItem('show_ai_button') !== 'false';
         $('#toggle_ai_button').prop('checked', show);