Add in-app local API key setup

Let fresh Docker and local installs enter OpenSky, AIS, and other provider keys directly in onboarding or Settings without manually creating .env files. Persist keys server-side in the backend data store, keep them write-only from the browser, reload runtime settings, and retain local-operator access controls.

backend/routers/admin.py

@@ -28,13 +28,34 @@ class TimeMachineToggle(BaseModel):
     enabled: bool
 
 
-@router.get("/api/settings/api-keys", dependencies=[Depends(require_admin)])
+@router.get("/api/settings/api-keys", dependencies=[Depends(require_local_operator)])
 @limiter.limit("30/minute")
 async def api_get_keys(request: Request):
     from services.api_settings import get_api_keys
     return get_api_keys()
 
 
+@router.put("/api/settings/api-keys", dependencies=[Depends(require_local_operator)])
+@limiter.limit("10/minute")
+async def api_save_keys(request: Request):
+    from services.api_settings import save_api_keys
+    body = await request.json()
+    if not isinstance(body, dict):
+        return Response(
+            content=json_mod.dumps({"ok": False, "detail": "Expected a JSON object."}),
+            status_code=400,
+            media_type="application/json",
+        )
+    result = save_api_keys({str(k): str(v) for k, v in body.items()})
+    if result.get("ok"):
+        return result
+    return Response(
+        content=json_mod.dumps(result),
+        status_code=400,
+        media_type="application/json",
+    )
+
+
 @router.get("/api/settings/api-keys/meta")
 @limiter.limit("30/minute")
 async def api_get_keys_meta(request: Request):