Redact the AI key from model lists and fit the longest prompt

GET /settings/ai/models now removes the stored API key from every model
ID and display name the provider returns, so a provider that echoes the
key in a successful list cannot disclose it.

PATCH /settings/ai gets its own body limit, sized for 8,000 characters at
12 bytes of JSON each (a \u-escaped surrogate pair) plus the other
fields. A valid prompt of three- or four-byte characters was refused by
the shared 16 KiB limit; the 8,000-character rule stays the only limit
on the prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/ai/aisettings/aisettings.go

@@ -217,7 +217,8 @@ func (s *Service) Verify(ctx context.Context) (Settings, error) {
 	})
 }
 
-// Models returns the provider's live model list. Its errors are Verify's.
+// Models returns the provider's live model list with the API key removed
+// from every model's ID and display name. Its errors are Verify's.
 func (s *Service) Models(ctx context.Context) ([]Model, error) {
 	row, err := s.read(ctx, db.New(s.st.Reader))
 	if err != nil {
@@ -233,7 +234,7 @@ func (s *Service) Models(ctx context.Context) ([]Model, error) {
 	}
 	out := make([]Model, len(models))
 	for i, m := range models {
-		out[i] = Model{ID: m.ID, DisplayName: m.DisplayName}
+		out[i] = Model{ID: llm.Redact(m.ID, key), DisplayName: llm.Redact(m.DisplayName, key)}
 	}
 	return out, nil
 }

internal/ai/aisettings/aisettings_test.go

@@ -352,6 +352,11 @@ func TestVerifyRedactsKey(t *testing.T) {
 	if _, err := s.Models(ctx); !errors.Is(err, ErrProviderFailed) || strings.Contains(err.Error(), testKey) {
 		t.Errorf("Models = %v, want ErrProviderFailed without the key", err)
 	}
+	f.QueueListModels(llm.ListModelsResult{Models: []llm.Model{{ID: "m-" + testKey, DisplayName: "Model " + testKey}}})
+	models, err := s.Models(ctx)
+	if err != nil || len(models) != 1 || models[0] != (Model{ID: "m-[REDACTED]", DisplayName: "Model [REDACTED]"}) {
+		t.Errorf("Models = %+v, %v, want the key redacted", models, err)
+	}
 }
 
 // Settings changed while the provider verifies the key are not marked