Redact the AI key from model lists and fit the longest prompt

GET /settings/ai/models now removes the stored API key from every model
ID and display name the provider returns, so a provider that echoes the
key in a successful list cannot disclose it.

PATCH /settings/ai gets its own body limit, sized for 8,000 characters at
12 bytes of JSON each (a \u-escaped surrogate pair) plus the other
fields. A valid prompt of three- or four-byte characters was refused by
the shared 16 KiB limit; the 8,000-character rule stays the only limit
on the prompt.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/server/aisettings.go

@@ -21,8 +21,8 @@ type modelsResponse struct {
 }
 
 // No response from these handlers holds the API key: the settings carry
-// only its last four characters, and provider errors are redacted by
-// package aisettings.
+// only its last four characters, and provider errors and model lists are
+// redacted by package aisettings.
 
 func getAISettings(logger *slog.Logger, svc *aisettings.Service) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
@@ -38,7 +38,7 @@ func getAISettings(logger *slog.Logger, svc *aisettings.Service) http.HandlerFun
 
 func patchAISettings(logger *slog.Logger, svc *aisettings.Service) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
-		patch, err := decodePatch[aisettings.Patch](http.MaxBytesReader(w, r.Body, maxSettingsBody))
+		patch, err := decodePatch[aisettings.Patch](http.MaxBytesReader(w, r.Body, maxAISettingsBody))
 		if err != nil {
 			writeError(w, r, logger, http.StatusBadRequest, "invalid_request", err.Error())
 			return