AI credentials

Bring your own OpenAI API key. Keys are encrypted server-side and never shown after saving.