v0.3.6

openproxy key add now works without restarting the server

Adding a key while the server was running produced a credential that 401'd until the operator restarted. Two independent causes, both required for the bug:

1. The CLI read its bearer credential from <data_dir>/db.json. SQLite has been the sole runtime store for a while and that file no longer exists, so the lookup failed on every current data dir and the CLI fell back to writing SQLite directly — leaving the server's in-memory AppDb snapshot stale.

2. POST /api/keys ignored the key field in the request body and always minted a secret of its own. Even once the POST went out, the value the CLI printed back was never the one stored.

Both halves are fixed. The CLI now borrows an active key through the same Db::load_from loader the server uses, and the endpoint honours a caller-supplied secret, falling back to minting when the field is absent — so the dashboard flow is unchanged and the browser still never sends a secret over the wire.

A supplied secret is shape-checked (sk-…, or op- with a real-length hex body) and rejected with 400 rather than stored unusable.

The two missing provider logos

web/public/providers/ was missing devin-cli.png and opendesign.png, which cliTools.ts references — so the devin and opendesign CLI-tool cards 404'd their image. Both added at 128×128.

Full Changelog: v0.3.5...v0.3.6