feat: API key settings page — store ANTHROPIC/VOYAGE keys in DB with admin UI

- Migration: app_settings table with admin-only RLS (ANTHROPIC_API_KEY, VOYAGE_API_KEY)
- lib/settings.ts: getApiKey() reads DB first, falls back to env var
- lib/claude/client.ts: factory createAnthropicClient(apiKey) replaces singleton
- lib/claude/embed.ts: optional apiKey param, falls back to env
- 3 Claude AI routes + similar route: fetch key from settings before calling AI
- incidents/route.ts: fire-and-forget embed reads VOYAGE key from settings
- GET/POST /api/settings: admin-only masked key management endpoint
- /hse/settings page + ApiKeyForm client component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

app/api/incidents/[id]/similar/route.ts

@@ -3,6 +3,7 @@ export const dynamic = 'force-dynamic'
 import { NextRequest, NextResponse } from 'next/server'
 import { createClient } from '@/lib/supabase/server'
 import { embedText } from '@/lib/claude/embed'
+import { getApiKey } from '@/lib/settings'
 
 export async function GET(
   _request: NextRequest,
@@ -17,6 +18,8 @@ export async function GET(
   if (!profile || !['hse', 'admin'].includes(profile.role))
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
 
+  const voyageKey = await getApiKey(supabase, 'VOYAGE_API_KEY')
+
   const { data: incident } = await supabase
     .from('incidents')
     .select('id, description, embedding')
@@ -31,7 +34,7 @@ export async function GET(
     if (inc.embedding) {
       embeddingVec = JSON.parse(inc.embedding) as number[]
     } else {
-      embeddingVec = await embedText(inc.description)
+      embeddingVec = await embedText(inc.description, voyageKey)
       await supabase.from('incidents').update({
         embedding: `[${embeddingVec.join(',')}]` as unknown as string,
       }).eq('id', id)