fix: use latest UI LLM settings for ingest

[wachiravit-thitagran]

Summary

• resolve persisted LLM settings at the start of every API or watcher file ingest
• stop upload requests and long-lived watchers from retaining stale credentials after Workbench settings are saved
• pass the freshly resolved key, base URL, headers, and timeout into local PageIndex calls without process-wide secret mutation
• add regressions for credential rotation, watcher freshness, and PageIndex provider validation

Root cause

The Workbench settings endpoints persisted changes correctly, but /api/v1/add captured a credential bundle once per upload request and the watcher captured one once at startup. Later UI saves therefore did not affect already-running multi-file uploads or watchers. Local PageIndex also validated only provider environment variables before its per-call settings were applied.

Impact

Each file ingest now reads the latest persisted UI settings immediately before processing, including files discovered by an already-running watcher. Concurrent KBs retain per-request credential isolation.

Validation

• pytest tests/test_indexer.py tests/test_add_command.py tests/test_api.py tests/test_watch_service.py::test_worker_does_not_reuse_bundle_captured_at_watcher_start -q - 226 passed
• ruff check and ruff format --check on changed files
• mypy openkb/api.py openkb/api_helpers.py openkb/cli.py openkb/indexer.py openkb/watch_service.py
• git diff --check