[Studio] Prevent General Settings API key exposure

[yx9o]

Problem

GET /api/settings/general returns the stored apiKey in plaintext, exposing it to the browser whenever General Settings is opened.

The current save behavior also cannot clearly distinguish between preserving and clearing an existing key.

Expected behavior

• Never return the stored API Key.
• Return only whether an API Key is configured.
• Preserve the existing key when the field is empty or omitted.
• Replace it when a new key is provided.
• Clear it only through an explicit action.

Proposed fix

Make apiKey write-only, expose apiKeyConfigured, add an explicit clearApiKey option, and update the frontend, tests, and API documentation accordingly.