perf: memo GridCard, fuse save fns, fix slash tab active color

memento-note/app/api/user/api-keys/[provider]/route.ts

@@ -1,6 +1,7 @@
 import { NextRequest, NextResponse } from 'next/server';
 import { auth } from '@/auth';
 import { prisma } from '@/lib/prisma';
+import { encryptApiKey, hashApiKey } from '@/lib/crypto';
 import { VALID_PROVIDERS } from '@/lib/ai/router';
 
 type RouteContext = { params: Promise<{ provider: string }> };
@@ -16,14 +17,34 @@ export async function PATCH(req: NextRequest, context: RouteContext) {
     return NextResponse.json({ error: 'Unknown provider' }, { status: 400 });
   }
 
-  const body = (await req.json().catch(() => ({}))) as { isActive?: boolean };
-  if (typeof body.isActive !== 'boolean') {
-    return NextResponse.json({ error: 'isActive boolean required' }, { status: 400 });
+  const body = (await req.json().catch(() => ({}))) as {
+    isActive?: boolean;
+    model?: string;
+    alias?: string;
+    baseUrl?: string;
+    apiKey?: string; // optional — only when rotating the key
+  };
+
+  const data: Record<string, unknown> = {};
+
+  if (typeof body.isActive === 'boolean') data.isActive = body.isActive;
+  if (body.model !== undefined) data.model = body.model || null;
+  if (body.alias !== undefined) data.alias = body.alias || '';
+  if (body.baseUrl !== undefined) data.baseUrl = body.baseUrl || null;
+
+  // Key rotation: only when new key explicitly provided
+  if (body.apiKey && body.apiKey.length >= 8) {
+    data.encryptedKey = await encryptApiKey(body.apiKey);
+    data.keyHash = hashApiKey(body.apiKey);
+  }
+
+  if (Object.keys(data).length === 0) {
+    return NextResponse.json({ error: 'No fields to update' }, { status: 400 });
   }
 
   const updated = await prisma.userAPIKey.updateMany({
     where: { userId: session.user.id, provider },
-    data: { isActive: body.isActive },
+    data,
   });
 
   if (updated.count === 0) {