MIKE-FIX-LLM: make DeepSeek the only production model and fix API key flow

From the PR description

MIKE-FIX-LLM-PRODUCTION-02: make DeepSeek the only production model and fix API key flow

Changes

• getUserApiKeyStatus resilience: returns partial status with env keys intact on DB failure (no throw)
• getUserApiKeySuffix: masked suffix (last 4 chars) for personal keys
• POST /user/api-keys/:provider/health: lightweight health check endpoint
• Settings UI: managed/personal/not-configured states, "Test key" button, health status display
• Only DeepSeek in Settings (removed Claude/Gemini/OpenAI fields)
• 11 new tests: async error handling (6) + API key resilience (5)
• ApiKeyStatus enriched: keySuffixes, editable flags in /user/profile response

Smoke test results

• GET /user/profile → 200, deepseek: true, source: "env", editable: false ✅
• PUT /user/api-keys/deepseek → 409 ✅
• POST /user/api-keys/deepseek/health → {"status":"healthy"} ✅
• Backend /ready → 200 (survived all tests) ✅
• Frontend /api/health → 200 ✅
• Security scan: no secrets in 74 JS chunks ✅
• 238 tests green (153 backend + 85 frontend) ✅