feat: API key settings page — store ANTHROPIC/VOYAGE keys in DB with admin UI

- Migration: app_settings table with admin-only RLS (ANTHROPIC_API_KEY, VOYAGE_API_KEY)
- lib/settings.ts: getApiKey() reads DB first, falls back to env var
- lib/claude/client.ts: factory createAnthropicClient(apiKey) replaces singleton
- lib/claude/embed.ts: optional apiKey param, falls back to env
- 3 Claude AI routes + similar route: fetch key from settings before calling AI
- incidents/route.ts: fire-and-forget embed reads VOYAGE key from settings
- GET/POST /api/settings: admin-only masked key management endpoint
- /hse/settings page + ApiKeyForm client component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

app/api/incidents/route.ts

@@ -110,11 +110,16 @@ export async function POST(request: Request) {
     .catch(err => console.error('email notification failed:', err))
 
   // Embed description asynchronously for future similarity search
-  import('@/lib/claude/embed').then(({ embedText }) =>
-    embedText(input.description.trim()).then(embedding =>
-      supabase.from('incidents').update({
-        embedding: `[${embedding.join(',')}]` as unknown as string,
-      }).eq('id', incident.id)
+  const supabaseForEmbed = supabase
+  import('@/lib/settings').then(({ getApiKey }) =>
+    getApiKey(supabaseForEmbed, 'VOYAGE_API_KEY').then(voyageKey =>
+      import('@/lib/claude/embed').then(({ embedText }) =>
+        embedText(input.description.trim(), voyageKey).then(embedding =>
+          supabase.from('incidents').update({
+            embedding: `[${embedding.join(',')}]` as unknown as string,
+          }).eq('id', incident.id)
+        )
+      )
     )
   ).catch(err => console.error('embed error:', err))