feat(settings): S1 AES-GCM crypto + Settings API/UI (masked write-only secrets)

- backend/crypto.py: AES-GCM (cryptography.AESGCM); key=base64(SLAB_AES_KEY)
  must be exactly 32 bytes; value_enc=base64(nonce(12)||ct); DecryptError on tamper
- backend/settings.py: get_settings (secrets->{configured:bool}, woo_base_url env
  read-only, flags default false), update_settings (rejects woo_base_url SETTINGS-85,
  encrypts secrets, partial plain writes)
- backend/app.py: wire GET/PUT /api/v1/settings
- frontend/src/create/settings/Settings.svelte: masked form + partial PUT
- tests: crypto roundtrip/tamper, masked GET, encrypted PUT, reject woo_base_url,
  flags default, decrypt-fail->configured:false (TDD)

Verified live: secrets round-trip configured:true with valid key; woo_base_url write
rejected 400; no secret leak in GET. Gates: check_requirements + check_coverage exit 0;
pytest 13 passed. Deploy+build on ubudual5060 (never Windows).

backend/app.py

@@ -19,9 +19,11 @@ from contextlib import asynccontextmanager
 
 from fastapi import FastAPI, HTTPException, Request
 from fastapi.middleware.cors import CORSMiddleware
+from fastapi.responses import JSONResponse
 from starlette.middleware.base import BaseHTTPMiddleware
 
 from .db import get_connection, init_db, probe_images_writable, probe_writable
+from . import settings as settings_mod
 
 __version__ = "0.5.0-m3-s0"
 
@@ -138,6 +140,13 @@ app.add_middleware(
 app.add_middleware(RequestIdMiddleware)
 
 
+@app.exception_handler(HTTPException)
+async def _unwrap_error(request: Request, exc: HTTPException):
+    if isinstance(exc.detail, dict) and "error" in exc.detail:
+        return JSONResponse(status_code=exc.status_code, content=exc.detail)
+    return JSONResponse(status_code=exc.status_code, content={"error": {"code": "validation" if exc.status_code == 400 else "internal", "message": str(exc.detail), "detail": None}})
+
+
 @app.get("/api/health")
 async def health() -> dict[str, Any]:
     """Health per APP-30/45: non-200 when db or image volume not writable (probe file)."""
@@ -159,5 +168,15 @@ async def meta() -> dict[str, Any]:
     return {"version": __version__}
 
 
+@app.get("/api/v1/settings")
+async def get_settings() -> dict[str, Any]:
+    return settings_mod.get_settings()
+
+
+@app.put("/api/v1/settings")
+async def put_settings(payload: dict[str, Any]) -> dict[str, Any]:
+    return settings_mod.update_settings(payload)
+
+
 # expose for tests
 __all__ = ["app", "__version__"]