Provider API keys

Keys are encrypted at rest and never shown again after saving. A key entered here overrides the matching environment variable.

Notes

• Encryption uses a master key from COLLIEBOT_SECRET_KEY, or an auto-generated .colliebot_secret file. Keep it safe and out of git — losing it means re-entering keys.
• Serve over HTTPS and set COLLIEBOT_ADMIN_TOKEN in production so keys aren't posted in the clear or to an unauthenticated dashboard.
• Anthropic keys → console.anthropic.com; Gemini keys → aistudio.google.com/apikey.