AI provider keys (behind the gateway), permission-tier rules, backup status, and audit-log viewer. (Milestone 7)