Update Hosted Provider

Rotate the key, repoint the base, or turn a provider off.

provider and name are immutable: changing either is a delete plus a create, because the key belongs to the provider it was issued by and requests address the name. Omitting api_key leaves the stored credential untouched, so a toggle never re-sends a secret the caller does not have; an explicit null removes it, where the provider can be served without one. client_args omitted is left alone; an explicit null clears it, and an entry echoed back as the mask keeps the stored value. restricted_to_organization_id reads the same way: omitted keeps the restriction, null lifts it.

One hosted provider, known by its name, its implementation and the tail of its key.

No shape in this section carries key material: a stored credential is known by its last four characters and nothing else, client_args goes out with credential-shaped values masked, and api_base with the password in its userinfo and its query values masked.

name is what requests address and every route takes; provider is the any-llm implementation. source says where the provider is defined. A config provider comes from the hosted_providers: block, has no row and so no id or timestamps, and is changed by editing the configuration rather than through this API; its models are administered as a stored provider's are. shadows_config marks a stored provider that wins over a configuration entry of the same name, which serves again once the row is deleted. has_api_key is false for one stored without a key, and decryptable false for one whose key or extras no configured OTARI_SECRET_KEY reads, which serves nothing until re-entered.