fix: handle missing ENCRYPTION_KEY in API key save routes and fix openrouter provider type

The encrypt() call threw an unhandled error when ENCRYPTION_KEY env var was missing,
causing a 500 that the frontend displayed as "Netzwerkfehler beim Speichern des Schlüssels".
Now returns a clear error message. Also fixed provider type cast that excluded 'openrouter'.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

src/app/api/settings/api-keys/[id]/route.ts

@@ -50,7 +50,14 @@ export async function PATCH(
     auditDetails.isActive = isActive;
   }
   if (apiKey && typeof apiKey === 'string' && apiKey.length >= 8) {
-    updates.encryptedKey = encrypt(apiKey);
+    try {
+      updates.encryptedKey = encrypt(apiKey);
+    } catch {
+      return Response.json(
+        { error: 'Serverkonfigurationsfehler: Verschlüsselung nicht verfügbar. Bitte ENCRYPTION_KEY prüfen.' },
+        { status: 500 },
+      );
+    }
     updates.keyHint = keyHint(apiKey);
     auditDetails.keyRotated = true;
   }

src/app/api/settings/api-keys/route.ts

@@ -60,7 +60,7 @@ export async function POST(request: Request) {
     .where(
       and(
         eq(tenantApiKeys.tenantId, ctx.tenantId),
-        eq(tenantApiKeys.provider, provider as 'anthropic' | 'openai' | 'ollama'),
+        eq(tenantApiKeys.provider, provider as AIProvider),
         label ? eq(tenantApiKeys.label, label) : undefined,
       ),
     )
@@ -73,14 +73,22 @@ export async function POST(request: Request) {
     );
   }
 
-  const encryptedKey = encrypt(apiKey);
+  let encryptedKey: string;
+  try {
+    encryptedKey = encrypt(apiKey);
+  } catch {
+    return Response.json(
+      { error: 'Serverkonfigurationsfehler: Verschlüsselung nicht verfügbar. Bitte ENCRYPTION_KEY prüfen.' },
+      { status: 500 },
+    );
+  }
   const hint = keyHint(apiKey);
 
   const [created] = await db
     .insert(tenantApiKeys)
     .values({
       tenantId: ctx.tenantId,
-      provider: provider as 'anthropic' | 'openai' | 'ollama',
+      provider: provider as AIProvider,
       encryptedKey,
       keyHint: hint,
       label: label || null,