secrets tab, drop commute filter, favicon, robust error reports

1. Admin → Geheimnisse sub-tab lets you edit ANTHROPIC_API_KEY +
   BERLIN_WOHNEN_USERNAME/PASSWORD at runtime. Migration v7 adds a
   secrets(key,value,updated_at) table; startup seeds missing keys from
   env (idempotent). web reads secrets DB-first (env fallback) via
   llm._api_key(); alert fetches them from web /internal/secrets on each
   scan, passes them into Scraper(). Rotating creds no longer needs a
   redeploy.
   Masked display: 6 leading + 4 trailing chars, "…" in the middle.
   Blank form fields leave the stored value untouched.

2. Drop the max_morning_commute filter from UI + server + FILTER_KEYS +
   filter summary (the underlying Maps.calculate_score code stays for
   potential future re-enable).

3. /static/didi.webp wired as favicon via <link rel="icon"> in base.html.

4. apply.open_page wraps page.goto in try/except so a failed load still
   produces a "goto.failed" step + screenshot instead of returning an
   empty forensics blob. networkidle + post-submission sleep are also
   made best-effort. The error ZIP export already writes screenshot+HTML
   per step and final_html — with this change every apply run leaves a
   reconstructable trail even when the listing is already offline.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

web/llm.py

@@ -12,10 +12,22 @@ from typing import Optional
 
 import requests
 
+import db
 from settings import ANTHROPIC_API_KEY, ANTHROPIC_MODEL
 
 logger = logging.getLogger("web.llm")
 
+
+def _api_key() -> str:
+    """DB-first so the admin UI can rotate the key without a redeploy."""
+    try:
+        k = db.get_secret("ANTHROPIC_API_KEY")
+        if k:
+            return k
+    except Exception:
+        pass
+    return ANTHROPIC_API_KEY
+
 API_URL = "https://api.anthropic.com/v1/messages"
 API_VERSION = "2023-06-01"
 
@@ -54,7 +66,8 @@ SYSTEM_PROMPT = (
 def select_flat_image_urls(candidates: list[str], page_url: str,
                            timeout: int = 30) -> list[str]:
     """Return the LLM-filtered subset, or the original list on any failure."""
-    if not ANTHROPIC_API_KEY or not candidates:
+    key = _api_key()
+    if not key or not candidates:
         return candidates
 
     user_text = (
@@ -78,7 +91,7 @@ def select_flat_image_urls(candidates: list[str], page_url: str,
         r = requests.post(
             API_URL,
             headers={
-                "x-api-key": ANTHROPIC_API_KEY,
+                "x-api-key": key,
                 "anthropic-version": API_VERSION,
                 "content-type": "application/json",
             },