feat(settings): S1 AES-GCM crypto + Settings API/UI (masked write-only secrets)

- backend/crypto.py: AES-GCM (cryptography.AESGCM); key=base64(SLAB_AES_KEY)
  must be exactly 32 bytes; value_enc=base64(nonce(12)||ct); DecryptError on tamper
- backend/settings.py: get_settings (secrets->{configured:bool}, woo_base_url env
  read-only, flags default false), update_settings (rejects woo_base_url SETTINGS-85,
  encrypts secrets, partial plain writes)
- backend/app.py: wire GET/PUT /api/v1/settings
- frontend/src/create/settings/Settings.svelte: masked form + partial PUT
- tests: crypto roundtrip/tamper, masked GET, encrypted PUT, reject woo_base_url,
  flags default, decrypt-fail->configured:false (TDD)

Verified live: secrets round-trip configured:true with valid key; woo_base_url write
rejected 400; no secret leak in GET. Gates: check_requirements + check_coverage exit 0;
pytest 13 passed. Deploy+build on ubudual5060 (never Windows).

frontend/src/App.svelte

@@ -3,12 +3,13 @@
   import { supported } from './browser';
   import { createCaptureSession, type CaptureSession } from './capture/session';
   import type { Capture } from './capture/capture.types';
-  import Resume from './capture/Resume.svelte';
-  import BatchPhotos from './capture/BatchPhotos.svelte';
-  import PickCalibration from './capture/PickCalibration.svelte';
-  import MaskPanel from './capture/MaskPanel.svelte';
-  import AxisPanel from './capture/AxisPanel.svelte';
-  import MeasurePanel from './capture/MeasurePanel.svelte';
+import Resume from './capture/Resume.svelte';
+import BatchPhotos from './capture/BatchPhotos.svelte';
+import PickCalibration from './capture/PickCalibration.svelte';
+import MaskPanel from './capture/MaskPanel.svelte';
+import AxisPanel from './capture/AxisPanel.svelte';
+import MeasurePanel from './capture/MeasurePanel.svelte';
+import Settings from './create/settings/Settings.svelte';
 
   const gate = typeof window !== 'undefined' ? supported() : 'window unavailable';
   const session: CaptureSession = createCaptureSession();
@@ -16,6 +17,7 @@
   let cap: Capture = { k: 'batch', photos: [] };
   let busy = false;
   let pngUrl: string | null = null;
+  let showSettings = false;
 
   const unsubCap = session.capture.subscribe((c) => {
     cap = c;
@@ -88,6 +90,10 @@
         {pngUrl}
       />
     {/if}
+    <button on:click={() => (showSettings = !showSettings)} style="margin-top:1rem">Settings (dev)</button>
+    {#if showSettings}
+      <Settings />
+    {/if}
   </main>
 {/if}