feat: API key management UI for connecting external AI models

[notyorch]

Overview

Onboarding new clients requires connecting their AI models (OpenAI, Anthropic, NVIDIA, custom endpoints) to TUP. Currently this is done via environment variables only, which requires server access and a container restart — a poor UX for non-technical users.

Problem

• Adding a new model requires editing .env and restarting containers
• No visibility into which models are currently connected
• Collectors can't be configured per-model dynamically
• Blocks self-serve onboarding flow

Proposed Solution

Add an API Key Management section to the dashboard that lets users register, rotate, and revoke model connections without touching the server.

Data Model

ModelConnection
  - id: UUID
  - workspace_id: UUID
  - display_name: string        (e.g. "Production GPT-4o")
  - provider: enum              (openai, anthropic, nvidia, ollama, custom)
  - endpoint_url: string
  - api_key: encrypted string   (stored encrypted, never returned in full)
  - status: active | inactive
  - created_at, last_used_at

Changes Required

Backend (tup-manager)

• Add model_connections table
• Encrypt API keys at rest (AES-256 or via KMS)
• POST /api/v1/connections — register new connection
• GET /api/v1/connections — list connections (masked keys)
• DELETE /api/v1/connections/:id — revoke
• POST /api/v1/connections/:id/test — test connectivity
• Wire active connections into collector config dynamically

Frontend (tup-dashboard)

• Settings > Connections page
• "Add Connection" modal with provider selector
• Connection status indicator (green/red)
• "Test Connection" button
• Rotate key flow (enter new key without deleting connection)

Security Requirements

• Keys must never be returned in full after creation (show only last 4 chars)
• All connection endpoints require authentication + workspace scope
• Key rotation must be atomic (no window where old key is deleted before new is validated)

Acceptance Criteria

• User can add an OpenAI connection from the dashboard without touching .env
• Connection test returns latency + model list if successful
• Revoked keys are immediately rejected by the collector
• Keys are stored encrypted in the database

Priority

🟡 Low — major UX improvement for self-serve onboarding, not MVP-blocking