feat: API key settings page — store ANTHROPIC/VOYAGE keys in DB with admin UI

- Migration: app_settings table with admin-only RLS (ANTHROPIC_API_KEY, VOYAGE_API_KEY)
- lib/settings.ts: getApiKey() reads DB first, falls back to env var
- lib/claude/client.ts: factory createAnthropicClient(apiKey) replaces singleton
- lib/claude/embed.ts: optional apiKey param, falls back to env
- 3 Claude AI routes + similar route: fetch key from settings before calling AI
- incidents/route.ts: fire-and-forget embed reads VOYAGE key from settings
- GET/POST /api/settings: admin-only masked key management endpoint
- /hse/settings page + ApiKeyForm client component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

supabase/migrations/20260711000014_app_settings.sql

@@ -0,0 +1,25 @@
+create table if not exists app_settings (
+  key        text primary key,
+  value      text not null,
+  updated_at timestamptz not null default now(),
+  updated_by uuid references users(id)
+);
+
+-- Only admins can read or write settings
+alter table app_settings enable row level security;
+
+create policy "admin_select_settings" on app_settings
+  for select using (
+    exists (select 1 from users where id = auth.uid() and role = 'admin')
+  );
+
+create policy "admin_update_settings" on app_settings
+  for all using (
+    exists (select 1 from users where id = auth.uid() and role = 'admin')
+  );
+
+-- Placeholder rows (empty value means "use env var")
+insert into app_settings (key, value) values
+  ('ANTHROPIC_API_KEY', ''),
+  ('VOYAGE_API_KEY', '')
+on conflict (key) do nothing;