Redact the AI key from model lists and fit the longest prompt

GET /settings/ai/models now removes the stored API key from every model
ID and display name the provider returns, so a provider that echoes the
key in a successful list cannot disclose it.

PATCH /settings/ai gets its own body limit, sized for 8,000 characters at
12 bytes of JSON each (a \u-escaped surrogate pair) plus the other
fields. A valid prompt of three- or four-byte characters was refused by
the shared 16 KiB limit; the 8,000-character rule stays the only limit
on the prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -166,7 +166,8 @@ automatic** (D-021).
   only when its base_url passes `secureurl.Check`. `POST /api/v1/settings/ai/verify` calls
   `Provider.Verify` and records `key_verified_at`;
   `GET /api/v1/settings/ai/models` returns `{models: [{id, display_name}]}`
-  live from the provider. Both work before a model is chosen
+  live from the provider, with the key redacted from every id and
+  display_name. Both work before a model is chosen
   (`presets.ForAccount`), answer 409 `not_configured` when the settings
   cannot build a provider, and 502 with the provider's typed error
   (`auth_failed`, `rate_limited`, `bad_output`, `provider_error`; 504