feat: API key settings page — store ANTHROPIC/VOYAGE keys in DB with admin UI

- Migration: app_settings table with admin-only RLS (ANTHROPIC_API_KEY, VOYAGE_API_KEY)
- lib/settings.ts: getApiKey() reads DB first, falls back to env var
- lib/claude/client.ts: factory createAnthropicClient(apiKey) replaces singleton
- lib/claude/embed.ts: optional apiKey param, falls back to env
- 3 Claude AI routes + similar route: fetch key from settings before calling AI
- incidents/route.ts: fire-and-forget embed reads VOYAGE key from settings
- GET/POST /api/settings: admin-only masked key management endpoint
- /hse/settings page + ApiKeyForm client component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

lib/claude/client.ts

@@ -1,5 +1,5 @@
 import Anthropic from '@anthropic-ai/sdk'
 
-export const anthropic = new Anthropic({
-  apiKey: process.env.ANTHROPIC_API_KEY ?? '',
-})
+export function createAnthropicClient(apiKey: string): Anthropic {
+  return new Anthropic({ apiKey })
+}

lib/claude/embed.ts

@@ -1,10 +1,11 @@
-export async function embedText(text: string): Promise<number[]> {
-  if (!process.env.VOYAGE_API_KEY) throw new Error('VOYAGE_API_KEY is not set')
+export async function embedText(text: string, apiKey?: string): Promise<number[]> {
+  const key = apiKey ?? process.env.VOYAGE_API_KEY
+  if (!key) throw new Error('VOYAGE_API_KEY is not set')
   const res = await fetch('https://api.voyageai.com/v1/embeddings', {
     method: 'POST',
     headers: {
       'Content-Type': 'application/json',
-      'Authorization': `Bearer ${process.env.VOYAGE_API_KEY}`,
+      'Authorization': `Bearer ${key}`,
     },
     body: JSON.stringify({ input: [text], model: 'voyage-3-lite' }),
   })

lib/settings.ts

@@ -0,0 +1,17 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+
+export async function getApiKey(supabase: SupabaseClient, key: string): Promise<string> {
+  try {
+    const { data } = await supabase
+      .from('app_settings')
+      .select('value')
+      .eq('key', key)
+      .single()
+    if (data?.value) return data.value
+  } catch {
+    // fall through to env
+  }
+  const env = process.env[key]
+  if (env) return env
+  throw new Error(`${key} not configured. Add it in Settings (/hse/settings) or as an environment variable.`)
+}