fix(phase-4): add DB error checking, mask sensitive auth tokens in API and middleware logs

internal/server/system.go

@@ -67,18 +67,27 @@ func (s *Server) handleGetSettings(c *gin.Context) {
 	providerCount := 0
 	modelCount := 0
 	s.registryMu.RLock()
-	defer s.registryMu.RUnlock()
 	if s.registry != nil {
 		providerCount = len(s.registry.Providers)
 		for _, p := range s.registry.Providers {
 			modelCount += len(p.Models)
 		}
 	}
+	s.registryMu.RUnlock()
+
+	maskedTokens := make([]string, len(s.cfg.Server.AuthTokens))
+	for i, token := range s.cfg.Server.AuthTokens {
+		if len(token) > 8 {
+			maskedTokens[i] = token[:3] + "••••" + token[len(token)-4:]
+		} else {
+			maskedTokens[i] = "••••"
+		}
+	}
 
 	c.JSON(http.StatusOK, SuccessResponse(gin.H{
 		"server": gin.H{
 			"version":     "1.0.0-go",
-			"auth_tokens": s.cfg.Server.AuthTokens,
+			"auth_tokens": maskedTokens,
 		},
 		"database": gin.H{
 			"type": "sqlite",