feat: API-Keys-Verwaltung in DB statt appsettings

- Neue Tabelle api_keys (Provider, Name, ApiKey, IsActive)
- Admin-CRUD: GET/POST/PUT/DELETE /api/admin/api-keys
- Aktivieren/Deaktivieren pro Provider (nur einer aktiv)
- Live-Token-Update im AnthropicService ohne Neustart
- Migration: AnthropicToken aus appsettings.Production.json → DB
- AnthropicToken aus ServerSettings-Definitionen + appsettings entfernt
- Frontend: API-Keys-Seite mit Erstellen/Bearbeiten/Löschen/Toggle
- Dashboard: API-Keys-Link für Admins

Program.cs

@@ -53,7 +53,13 @@ builder.Services.AddSingleton(embeddingBgService);
 builder.Services.AddHostedService(sp => sp.GetRequiredService<Gott.Services.EmbeddingBackgroundService>());
 
 // AnthropicService (Singleton – shared zwischen ChatEndpoint und TelegramService)
-var anthropicToken = builder.Configuration["AnthropicToken"] ?? "";
+// Token wird aus DB geladen (api_keys Tabelle), Fallback auf Config
+var anthropicToken = "";
+var activeKey = dbService.GetActiveApiKey("anthropic").GetAwaiter().GetResult();
+if (activeKey != null)
+    anthropicToken = activeKey.ApiKey;
+else if (!string.IsNullOrWhiteSpace(builder.Configuration["AnthropicToken"]))
+    anthropicToken = builder.Configuration["AnthropicToken"];
 var payloadLogging = builder.Configuration.GetValue<bool>("PayloadLogging", false);
 var payloadLoggingGzip = builder.Configuration.GetValue<bool>("PayloadLoggingGzip", false);
 builder.Services.AddSingleton<AnthropicService>(sp =>
@@ -116,6 +122,7 @@ app.MapKreaEndpoints();
 app.MapSharedEndpoints();
 app.MapAdminEndpoints();
 app.MapServerSettingsEndpoints();
+app.MapApiKeysEndpoints();
 app.MapOpenClawEndpoints();
 app.MapRemoteEndpoints();