feat(settings): warn users before submitting API keys

[yipwingtim]

Closes #441.

Problem

OpenMAIC sends user-supplied provider credentials to the server so the server can call external AI services on the
user's behalf.

On publicly deployed instances, users may not realize that entering an API key gives the deployment operator access to
that credential.

Changes

• add a small security notice near user-editable provider credential fields
• explain that credentials are sent to the server hosting the current instance
• remind users to enter credentials only when they trust the deployment operator
• show the notice for:
  • LLM providers
  • TTS and ASR providers
  • web search providers
  • image and video providers
  • PDF providers
• keep server-configured provider flows unchanged
• add localized copy for English and Simplified Chinese
• use the English notice as the fallback for other supported locales

Scope

This is a UX/security-awareness change only.

It does not change:

• credential storage or transmission behavior
• provider APIs
• server-side configuration
• authentication or authorization

Configurable notice content and client-side direct mode remain out of scope.

Validation

• ESLint passed
• TypeScript check passed
• i18n key alignment check passed
• git diff --check passed