* fix: mask API keys in provider endpoint responses
The GET /llm_toolkit/providers endpoint now returns masked keys
(e.g. "sk-••••••xxxx") instead of full API keys. The POST save
handler preserves existing keys when it receives a masked value,
and the check-connectivity endpoint accepts a providerId to look
up the real key server-side instead of requiring it from the frontend.
* fix: prioritize user-typed key over stored key in check endpoint