bug : Unauthenticated /save-api-config mutates process-global API settings and breaks multi-user isolation

[yomo40]

The backend publicly exposes POST /save-api-config without any authentication or session isolation. Upon receiving a request, the API directly writes the API key, model, and base URL of the coordinator/modeler/coder/writer into the global settings object. The frontend then persists these configurations to the Pinia store.

Warning

which means a single user can directly modify the runtime configuration of the entire backend process, affecting the tasks of all other users.