Qt-removal R7.4a: API-provider settings page (backend+frontend)

[dovvnloading]

Summary

Closes part of the R2.5d-flagged Settings deferral: API-provider (OpenAI-Compatible / Anthropic Claude / Google Gemini endpoint config, per-task model assignment, live catalog refresh, write-only key persistence) is now real in the new backend/frontend stack. Ollama and Llama.cpp remain deferred as R7.4b/R7.4c.

What Changed

• backend/settings.py — 4 new intents on the existing app-settings topic: setViewingApiProvider, loadApiModels, saveApiConfiguration, resetApiSettings. Reuses the established asyncio.to_thread + _manager_lock pattern already used for General/Integrations.
• graphlink_app/graphlink_app_settings_payload.py — extended AppSettingsStatePayload with 10 new fields (incl. a nested ApiModelDescriptorPayload); codegen regenerated the TS contract.
• web_ui/src/app/chrome/SettingsDialog.tsx — new ApiProviderPage (provider select, base URL, write-only key field, per-task model inputs with datalist suggestions, Load/Save/Reset), wired into the existing rail-nav dialog.
• Tests: 30 new/updated backend tests in backend/tests/test_settings.py, plus 2 new fully-portable files ported from legacy (test_backend_secrets_at_rest.py, test_backend_api_key_env_fallback.py — test_backend_* naming avoids a basename collision with the still-present legacy files, matching the test_backend_composer.py precedent). 11 new frontend tests in SettingsDialog.test.tsx (the first dedicated test file for this dialog).

Design decision worth flagging

The API key field never pre-fills with the real key on a provider switch — the old Qt widget did, which was only safe because it lived in-process with no serialization boundary. This page follows the write-only pattern already established for the GitHub token instead: apiKeyConfigured is a per-provider bool, and saving requires retyping the full key. This is a deliberate security improvement over legacy parity, not an oversight.

Adversarial review

A 4-way review (backend/frontend/integration/security) surfaced 11 findings; 9 confirmed after independent adversarial verification and all fixed with regression tests:

• Data-loss race in save_api_configuration: the other 2 providers' "keep as-is" keys were read outside the lock, before an await — a concurrent save for a different provider could get silently reverted. Fixed by moving the read inside the locked _persist().
• Matching race in load_api_models against api_provider.py's process-global state — fixed with a post-hoc consistency check.
• Security regression: a rejected API key could ride inside a raw provider-SDK exception straight into a WS-broadcast message, unredacted. Fixed with a _redact() helper (the legacy bridge had this redaction; the port had dropped it).
• Catalog-refresh status/message were flat cells that leaked one provider's outcome onto another provider's page after a switch — fixed by keying catalog state per-provider.
• Reset API Settings only cleared the local key draft, leaving stale Base URL/model drafts a subsequent Save could silently re-persist.
• An uncaught AttributeError on a non-dict intent argument.

Validation

• python -m compileall -q . passes
• tests/test_no_qt_anywhere.py — burn-down pin unchanged at 152/84/68
• Full backend suite: 2430 passed
• Frontend: 1064 vitest passed, tsc/eslint/build clean
• Live drive against a real running FastAPI/uvicorn backend over a genuine WebSocket (isolated scratch settings file — the real ~/.graphlink/session.dat was never touched), confirming the real wire payload shape, real validation notices, a real network-failure path with confirmed key redaction, and a real reset round-trip

Additional Context

Part of the Qt-removal parity/cutover phase (R7.4). Next: R7.4b (Ollama settings page — model scan/pull via the same asyncio.to_thread idiom).