feat: Perplexity API key override and opt-in model allowlist

[cotdp]

Summary

Adds settings to control Perplexity usage — overriding the API key and toggling which models are enabled, defaulting to sonar-only with the expensive models opt-in for cost control.

• API key override: configurable at runtime via POST /api/config (seeded from PERPLEXITY_API_KEY at startup). Masked everywhere it's surfaced (pplx...7890); the real value is only used internally.
• Model allowlist (opt-in): only sonar is enabled by default. sonar-pro, sonar-reasoning, sonar-reasoning-pro, and sonar-deep-research must be enabled explicitly via PERPLEXITY_ENABLED_MODELS (env, comma-separated) or perplexity_enabled_models (runtime config). A disabled model is rejected before any billable API call and recorded as a 403 in metrics. Unknown model names are rejected with a clear error.
• Reasoning tool: model is configurable via PERPLEXITY_REASONING_MODEL (default sonar-reasoning-pro) and is gated by the allowlist — so perplexity_reason returns a "model not enabled" error until opted in (by design).
• Service reads the key/enabled-models dynamically and rebuilds the SDK client when the key changes. Adds a config://perplexity resource.

Test plan

• pytest — 142 passing (new tests: model gating, opt-in allowed, reason-blocked-by-default, runtime key override, API-key masking, env parsing, model validation)
• ruff check + ruff format — clean
• mypy src/ — no new errors vs. main baseline
• End-to-end check: disabled model gated without API call; opt-in enables it; key masked in GET /api/config

Note: .env.example could not be updated (blocked by local security policy). New optional vars to document there: PERPLEXITY_ENABLED_MODELS, PERPLEXITY_REASONING_MODEL.

🤖 Generated with Claude Code