fix: settings dialog and settings API correctness bugs

Seven correctness fixes in the admin settings dialog and settings API: AdminSecuritySettings save echoing read-only/redacted keys; the server persisting the ******** mask over real OIDC/SIEM secrets on a settings round trip; the Tools panel missing its settings:write gate; three swallowed errors (ToolsSection save, ApiKeys generate and delete); and generatePassword omitting a special char under passwordRequireSpecial. Adds an integration regression test for the secret-mask no-op.

apps/api/src/routes/settings.ts

@@ -104,6 +104,15 @@ export async function settingsRoutes(app: FastifyInstance): Promise<void> {
         });
       }
 
+      // A redacted secret comes back from GET as the literal mask, so a client that
+      // reads settings, edits one field, and saves the whole object echoes the mask
+      // back. Treat the mask as "leave this secret unchanged" instead of encrypting
+      // and persisting "********", which would destroy the real secret (e.g. the OIDC
+      // client secret or SIEM webhook auth, neither of which is read-only).
+      if (REDACTED_KEYS.has(key) && strValue === "********") {
+        continue;
+      }
+
       if (READONLY_KEYS.has(key)) {
         return reply.status(400).send({
           error: `Setting "${key}" cannot be modified via the API`,