- Remove server-side value='...' from password field in settings modal template
so the API key is never baked into the DOM at page load time
- Populate the input dynamically via loadSettingsToUI() when modal opens
- Clear both API key and proxy password fields on modal close to prevent
Firefox from detecting pre-filled password fields on page navigation