Dashboard: built-in tools & guardrails configuration

[njbrake]

Drafted by Claude via back-and-forth with @njbrake.

A page to configure the built-in tools and guardrails: web search, code execution/sandbox, and request guardrails.

Why: These are runtime-configurable services like providers, and the search/sandbox backends take API keys, so they fit the encrypt-at-rest, write-only pattern built for provider credentials.

Tasks

• Web search: engine selection, result limits, extract toggle, and backend API keys (e.g. Tavily/Exa) stored via secret_box.
• Code execution/sandbox: sandbox_url and purpose hint.
• Guardrails: guardrails_url and a reachability test.
• Reuse the encrypt-at-rest plus last4 write-only pattern for any secret.
• Backend: decide which of these become runtime-settable vs. startup-only.
• Hooks, a page, tests; rebuild bundle.

Part of #299.