[agenthaulk]

Summary

Adds a runtime LLM-provider switcher and API-key intake to the web workbench, so a user can pick a provider and supply its key from the frontend without editing YAML or restarting the server.

• Provider menu now lists YAML-configured providers and the built-in presets (deepseek / openai / openai_compatible / glm / claude / minimax), each tagged with its readiness. Enabling a preset no longer needs a config edit.
• POST /api/settings/llm (control-token gated like every other POST) registers/updates a provider and optionally injects an API key. activate flips the active default; the routing closure swaps its frozen config atomically under a lock and hands the replacement to the sidecar tool registry so every surface agrees.
• Frontend: the previously inert key field becomes the intake path — password input, cleared on save, never stored client-side. Presets missing a model/base_url reveal the needed inputs; the runtime strip re-hydrates from the save response (loopback binds never re-fetch /api/status).

Security model

The API key is injected into the server process environment only (the client resolves keys from env per call, so it takes effect on the next request). It is never persisted, echoed, or logged — durable keys keep the documented gitignored configs/*.local.env path.

Adversarial review of the credential path found the submitted-key flow airtight (no leak to any response, log, disk, job, run index, sidecar journal, or served HTML; the env-injection-via-payload attack is unreachable) and surfaced one issue that this PR fixes:

• base_url key-exfiltration (fixed). A web-writable base_url let a caller redirect an existing provider to an attacker URL with no key, so the next call would ship the host's standing key as a bearer token. Now a base_url change that moves an existing provider to a new host is refused unless the key is re-supplied in the same request — an attacker must bring their own (harmless) key. First-time preset setup (host+key together) is unaffected. No private-IP/SSRF blocklist is applied on purpose: a local self-hosted model (http://127.0.0.1:11434) is a first-class OpenAI-compatible endpoint.
• The target env-var name is validated before the runtime write (plain identifier; PATH/LD_PRELOAD/PYTHONPATH refused).
• The settings read-modify-write runs under a lock (no dropped registration on concurrent POSTs); /api/status snapshots the config once (no torn mid-swap read).

Build hygiene

Adds a .dockerignore. COPY docs/ copied from the build context with no knowledge of .gitignore, so gitignored local docs were being baked into the image and the tracked-release cleanliness gate went red inside the container (no .git there) while staying green in a checkout. The ignore file keeps local material, workspace outputs, and local secret configs out of the image context.

Docs

README.md gains a Switching providers from the Web UI subsection under LLM Provider Setup, and the integration checklists (docs/integration_workflow.md, docs/full_integration_test_prompt.md) are updated to the new runtime-memory-only key policy.

Tests / gates

• New tests/test_web_llm_settings.py pins the security contract: no key in any response, no key on workspace disk, 401 without token, the 400 taxonomy, provider-alias mapping, preset-metadata-only exposure, the base_url exfiltration guard, the reserved-env-var refusal, and the concurrent-save no-drop invariant.
• Full suite green locally (1989 passed) and in the rebuilt image (1976 passed, 13 skipped); release_safety_scan.py passes on 278 public files.
• Verified end-to-end in a Docker container against the mounted data set and a real UI click-through: preset registration flips readiness, the guard blocks a keyless redirect, switching back to the configured provider leaves its standing key intact, and no key touches disk.