feat: API key settings page — store ANTHROPIC/VOYAGE keys in DB with admin UI

- Migration: app_settings table with admin-only RLS (ANTHROPIC_API_KEY, VOYAGE_API_KEY)
- lib/settings.ts: getApiKey() reads DB first, falls back to env var
- lib/claude/client.ts: factory createAnthropicClient(apiKey) replaces singleton
- lib/claude/embed.ts: optional apiKey param, falls back to env
- 3 Claude AI routes + similar route: fetch key from settings before calling AI
- incidents/route.ts: fire-and-forget embed reads VOYAGE key from settings
- GET/POST /api/settings: admin-only masked key management endpoint
- /hse/settings page + ApiKeyForm client component

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FFDuBhMKvoWjrWT3ZnGmmr

tests/api/incidents/quality-check.test.ts

@@ -9,7 +9,7 @@ vi.mock('@/lib/supabase/server', () => ({
 }))
 
 vi.mock('@/lib/claude/client', () => ({
-  anthropic: {
+  createAnthropicClient: vi.fn().mockReturnValue({
     messages: {
       create: vi.fn().mockResolvedValue({
         content: [{
@@ -19,7 +19,11 @@ vi.mock('@/lib/claude/client', () => ({
         }],
       }),
     },
-  },
+  }),
+}))
+
+vi.mock('@/lib/settings', () => ({
+  getApiKey: vi.fn().mockResolvedValue('sk-test-key'),
 }))
 
 describe('POST /api/incidents/ai/quality-check', () => {