feat(chat): write API keys to OpenClaw and embed Control UI for chat

Part 1: API Key Integration
- Create electron/utils/openclaw-auth.ts to write keys to
  ~/.openclaw/agents/main/agent/auth-profiles.json
- Update provider:save and provider:setApiKey IPC handlers to
  persist keys to OpenClaw auth-profiles alongside ClawX storage
- Save API key to OpenClaw on successful validation in Setup wizard
- Pass provider API keys as environment variables when starting
  the Gateway process (ANTHROPIC_API_KEY, OPENROUTER_API_KEY, etc.)

Part 2: Embed OpenClaw Control UI for Chat
- Replace custom Chat UI with <webview> embedding the Gateway's
  built-in Control UI at http://127.0.0.1:{port}/?token={token}
- Add gateway:getControlUiUrl IPC handler to provide tokenized URL
- Enable webviewTag in Electron BrowserWindow preferences
- Override X-Frame-Options/CSP headers to allow webview embedding
- Suppress noisy control-ui token_mismatch stderr messages
- Add loading/error states for the embedded webview

This fixes the "No API key found for provider" error and replaces
the buggy custom chat implementation with OpenClaw's battle-tested
Control UI.

src/pages/Setup/index.tsx

@@ -551,7 +551,24 @@ function ProviderContent({
       setKeyValid(result.valid);
       
       if (result.valid) {
-        toast.success('API key validated successfully');
+        // Save the API key to both ClawX secure storage and OpenClaw auth-profiles
+        try {
+          await window.electron.ipcRenderer.invoke(
+            'provider:save',
+            {
+              id: selectedProvider,
+              name: selectedProviderData?.name || selectedProvider,
+              type: selectedProvider,
+              enabled: true,
+              createdAt: new Date().toISOString(),
+              updatedAt: new Date().toISOString(),
+            },
+            apiKey
+          );
+        } catch (saveErr) {
+          console.warn('Failed to persist API key:', saveErr);
+        }
+        toast.success('API key validated and saved');
       } else {
         toast.error(result.error || 'Invalid API key');
       }