Add in-app local API key setup

Let fresh Docker and local installs enter OpenSky, AIS, and other provider keys directly in onboarding or Settings without manually creating .env files. Persist keys server-side in the backend data store, keep them write-only from the browser, reload runtime settings, and retain local-operator access controls.

backend/tests/test_api_settings.py

@@ -0,0 +1,38 @@
+import os
+
+
+def test_save_api_keys_persists_write_only(tmp_path, monkeypatch):
+    from services import api_settings
+
+    key_store = tmp_path / "operator_api_keys.env"
+    backend_env = tmp_path / ".env"
+    monkeypatch.setattr(api_settings, "OPERATOR_KEYS_ENV_PATH", key_store)
+    monkeypatch.setattr(api_settings, "ENV_PATH", backend_env)
+    monkeypatch.delenv("OPENSKY_CLIENT_ID", raising=False)
+
+    result = api_settings.save_api_keys(
+        {
+            "OPENSKY_CLIENT_ID": "client-id-value",
+            "NOT_ALLOWED": "ignore-me",
+        }
+    )
+
+    assert result["ok"] is True
+    assert result["updated"] == ["OPENSKY_CLIENT_ID"]
+    assert "client-id-value" not in str(result)
+    assert os.environ["OPENSKY_CLIENT_ID"] == "client-id-value"
+    assert 'OPENSKY_CLIENT_ID="client-id-value"' in key_store.read_text(encoding="utf-8")
+    assert "NOT_ALLOWED" not in key_store.read_text(encoding="utf-8")
+
+
+def test_persisted_api_keys_load_when_process_env_blank(tmp_path, monkeypatch):
+    from services import api_settings
+
+    key_store = tmp_path / "operator_api_keys.env"
+    key_store.write_text('AIS_API_KEY="saved-ais-key"\n', encoding="utf-8")
+    monkeypatch.setattr(api_settings, "OPERATOR_KEYS_ENV_PATH", key_store)
+    monkeypatch.setenv("AIS_API_KEY", "")
+
+    api_settings.load_persisted_api_keys_into_environ()
+
+    assert os.environ["AIS_API_KEY"] == "saved-ais-key"