feat: add LLM provider settings to web UI with encrypted API key storage

Add full LLM configuration section to the setup page with provider
dropdown, model/API key fields for cloud providers (Anthropic, OpenAI,
Gemini), and endpoint/model fields for Ollama. API keys are encrypted
with AES-256-GCM and stored in the database.

internal/store/schema.sql

@@ -104,3 +104,12 @@ CREATE TABLE IF NOT EXISTS toggles (
     active       INTEGER NOT NULL DEFAULT 0,
     activated_at TEXT
 );
+
+CREATE TABLE IF NOT EXISTS llm_settings (
+    id          INTEGER PRIMARY KEY CHECK (id = 1),
+    provider    TEXT    NOT NULL DEFAULT 'none',
+    model       TEXT    NOT NULL DEFAULT '',
+    endpoint    TEXT    NOT NULL DEFAULT '',
+    api_key_enc TEXT    NOT NULL DEFAULT '',
+    updated_at  TEXT    NOT NULL DEFAULT (datetime('now'))
+);