fix(03): revise plans based on checker feedback

.planning/phases/03-operator-experience/03-02-PLAN.md

@@ -47,6 +47,10 @@ must_haves:
       to: "/api/portal/channels/{tenant_id}/test"
       via: "POST to send test message"
       pattern: "channels.*test"
+    - from: "packages/portal/app/(dashboard)/settings/api-keys/page.tsx"
+      to: "/api/portal/tenants/{tenant_id}/llm-keys"
+      via: "GET/POST/DELETE for BYO key CRUD (endpoints created in Plan 01 Task 3)"
+      pattern: "tenants.*llm-keys"
 ---
 
 <objective>
@@ -80,6 +84,13 @@ From packages/shared/shared/api/channels.py (created in Plan 01):
 # POST /api/portal/channels/{tenant_id}/test -> { "success": true, "message": "Test message sent" } (body: { channel_type })
 ```
 
+From packages/shared/shared/api/llm_keys.py (created in Plan 01 Task 3):
+```python
+# GET /api/portal/tenants/{tenant_id}/llm-keys -> [{ id, provider, label, key_hint, created_at }]
+# POST /api/portal/tenants/{tenant_id}/llm-keys -> { id, provider, label, key_hint, created_at } (body: { provider, label, api_key })
+# DELETE /api/portal/tenants/{tenant_id}/llm-keys/{key_id} -> 204
+```
+
 From packages/shared/shared/api/billing.py (created in Plan 01):
 ```python
 # POST /api/portal/billing/checkout -> { "checkout_url": "https://checkout.stripe.com/..." }
@@ -201,12 +212,12 @@ Established patterns:
   <action>
     1. Create `packages/portal/app/(dashboard)/settings/api-keys/page.tsx`:
        - Tenant-level settings page (per user decision — simpler than per-agent for v1)
-       - List existing BYO keys: show provider name, label, created date (NOT the key itself — never display decrypted keys)
+       - List existing BYO keys: show provider name, label, key_hint (last 4 chars), created date (NOT the key itself — never display decrypted keys)
        - "Add API Key" button opens a form:
          - Provider: select dropdown (OpenAI, Anthropic, Custom)
          - Label: text input (human-readable name, e.g., "Production OpenAI key")
          - API Key: password input (masked by default)
-         - Submit: POST to /api/portal/tenants/{tenant_id}/llm-keys (needs endpoint added to Plan 01's channels.py or a new file)
+         - Submit: POST to /api/portal/tenants/{tenant_id}/llm-keys (backend endpoint created in Plan 01 Task 3)
        - Delete button per key with confirmation dialog
        - Use shadcn/ui Card, Table, Dialog, Button, Input, Select components
        - react-hook-form + zod for validation (provider required, label 3-100 chars, key not empty)
@@ -217,14 +228,12 @@ Established patterns:
        - useDeleteLlmKey() — mutation DELETE /api/portal/tenants/{tenant_id}/llm-keys/{keyId}
 
     3. Add navigation link to settings/api-keys in the dashboard layout sidebar (if sidebar exists) or in the tenant detail page.
-
-    Note: The backend endpoints for LLM key CRUD may need to be added to Plan 01's API if not already included. If the endpoint doesn't exist yet, create it in this task: add routes to packages/shared/shared/api/channels.py or create a separate packages/shared/shared/api/llm_keys.py with GET (list, redacted), POST (encrypt + store), DELETE.
   </action>
   <verify>
     <automated>cd /home/adelorenzo/repos/konstruct/packages/portal && npx next build 2>&1 | tail -20</automated>
   </verify>
   <done>
-    - BYO API key settings page renders with list of existing keys (redacted)
+    - BYO API key settings page renders with list of existing keys (redacted — shows key_hint only)
     - Add key form validates and submits to backend
     - Delete key with confirmation dialog works
     - Portal builds without errors
@@ -264,7 +273,7 @@ Established patterns:
 - Operator can paste WhatsApp credentials via guided form
 - Onboarding wizard completes in 3 steps: connect -> configure -> test
 - Agent goes live automatically after successful test message
-- Operator can manage BYO API keys from settings page
+- Operator can manage BYO API keys from settings page (backed by Plan 01 Task 3 endpoints)
 - Portal builds without errors
 </success_criteria>