feat(web): token 数以 K 输入显示,已存凭证显示掩码占位(FIX-8)

- 新增 UnitInput 与 kind=tokens:上下文预算、单次 token 上限、自定义模型上下文窗口以 K 输入(允许小数),存储仍为原始 token 数;校验与提示用 K 表述;列表/详情 token 数统一 K/M 简写(formatTokens)
- 新增 SecretInput 与 kind=secret:已保存时显示「已设置 ••••••••」(有服务端掩码时带末 4 位),聚焦直接输入替换,留空保持,「清除」确认后保存生效;替换模型服务、TMDB、网页搜索、下载器、媒体服务器、浏览器服务、站点账号、Passkey、本机 Token 各处
- 统一只写凭证服务端语义:省略或空串 = 不变,null = 清除(contracts secretInput);下载器/媒体服务器新增清除;站点凭证同类更新可留空保持密码/Cookie/API Key/TOTP,TOTP 可 null 清除,不再误删 TOTP 与 UA
- contextBudget 最小值 4096→4000、contextWindow 1024→1000,便于按 K 填写
- 测试:换算与校验、SecretInput 渲染与状态、各接口留空不变/显式清除

Co-Authored-By: Claude Opus 5.5 <[email protected]>

apps/web/app/components/settings/pi-upstreams.tsx

@@ -19,6 +19,7 @@ import { StatusBadge } from "~/components/console/status-badge.tsx";
 import { Button } from "~/components/ui/button.tsx";
 import { errorMessage } from "~/lib/api.ts";
 import { formatRelative } from "~/lib/labels.ts";
+import { maskedDisplay, secretPatch } from "~/lib/secret.ts";
 import { formatDateTime } from "~/lib/utils.ts";
 import { PiOAuthLogin } from "./pi-oauth.tsx";
 import {
@@ -138,7 +139,7 @@ function UpstreamDrawer({
     v.model !== (upstream.defaultModel ?? "") ||
     v.thinking !== upstream.thinkingLevel ||
     v.baseUrl !== (upstream.baseUrl ?? "") ||
-    !!v.apiKey ||
+    v.apiKey !== "" ||
     v.enabled !== upstream.enabled ||
     envFields.some((f) => (v.env[f.name] ?? "") !== (upstream.extra.env?.[f.name] ?? ""));
 
@@ -148,19 +149,20 @@ function UpstreamDrawer({
       ? upstream.authKind === "oauth"
         ? "登录后可获取"
         : "先配置 API Key"
-      : v.apiKey.trim() || v.baseUrl !== (upstream.baseUrl ?? "")
+      : v.apiKey !== "" || v.baseUrl !== (upstream.baseUrl ?? "")
         ? "先保存 API Key / Base URL 再获取"
         : null;
 
   const save = async (e: React.FormEvent) => {
     e.preventDefault();
     const env = Object.fromEntries(Object.entries(v.env).filter(([, x]) => x.trim()));
+    const apiKey = secretPatch(v.apiKey);
     const parsed = PiUpstreamUpdate.safeParse({
       name: v.name.trim(),
       defaultModel: v.model.trim() || null,
       ...(showThinking ? { thinkingLevel: v.thinking } : {}),
       ...(showBaseUrl ? { baseUrl: v.baseUrl.trim() || null } : {}),
-      ...(v.apiKey.trim() ? { apiKey: v.apiKey.trim() } : {}),
+      ...(apiKey !== undefined ? { apiKey } : {}),
       enabled: v.enabled,
       ...(envFields.length ? { extra: { ...upstream.extra, env } } : {}),
     });
@@ -239,7 +241,7 @@ function UpstreamDrawer({
         {upstream.credentialMask ? (
           <>
             <dt className="text-muted-foreground">API Key</dt>
-            <dd className="font-mono">{upstream.credentialMask}</dd>
+            <dd className="font-mono">{maskedDisplay(upstream.credentialMask)}</dd>
           </>
         ) : null}
         {upstream.account ? (
@@ -372,10 +374,10 @@ function UpstreamDrawer({
             <FieldControl
               spec={{
                 name: "apiKey",
-                label: upstream.hasCredential ? "替换 API Key" : "API Key",
-                kind: "password",
+                label: "API Key",
+                kind: "secret",
+                secret: { set: () => upstream.hasCredential, mask: () => upstream.credentialMask, clearable: true },
                 wide: true,
-                hint: upstream.hasCredential ? "留空不修改" : undefined,
               }}
               value={v.apiKey}
               error={errors.apiKey}