ver. 0.317: klucz API — przycisk generowania + fix zapisu

- fix: api_key brakowało w whiteliście saveSettings() — wartość tracona przy zapisie
- feat: przycisk "Generuj" losowy 32-znakowy klucz, usunięto "(ordersPRO)" z nazwy
- fix: api.php routing przeniesiony przed global settings + Throwable error handling
- fix: ApiRouter catch Throwable zamiast Exception

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

autoload/admin/Controllers/SettingsController.php

@@ -471,8 +471,7 @@ class SettingsController
                 'label' => 'Htaccess cache',
                 'tab' => 'system',
             ]),
-            FormField::text('api_key', [
-                'label' => 'Klucz API (ordersPRO)',
+            FormField::custom('api_key', $this->renderApiKeyField($data['api_key'] ?? ''), [
                 'tab' => 'system',
             ]),
 
@@ -560,4 +559,23 @@ class SettingsController
 
         return $data;
     }
+
+    private function renderApiKeyField(string $value): string
+    {
+        $escaped = htmlspecialchars($value, ENT_QUOTES, 'UTF-8');
+
+        $js = "var c='ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789',"
+            . "k='';for(var i=0;i<32;i++){k+=c.charAt(Math.floor(Math.random()*c.length));}"
+            . "document.getElementById('api_key').value=k;";
+
+        return '<div class="form-group row">'
+            . '<label class="col-lg-4 control-label">Klucz API:</label>'
+            . '<div class="col-lg-8">'
+            . '<div class="input-group">'
+            . '<input type="text" id="api_key" class="form-control" name="api_key" value="' . $escaped . '" />'
+            . '<span class="input-group-addon btn btn-info" onclick="' . htmlspecialchars($js, ENT_QUOTES, 'UTF-8') . '">Generuj</span>'
+            . '</div>'
+            . '</div>'
+            . '</div>';
+    }
 }