Add tool settings files for configurable tool defaults

Tools can now ship with defaults.yaml containing configurable settings
that users can customize via settings.yaml (auto-created from defaults).

Features:
- ensure_settings() helper copies defaults to settings on first use
- Settings available as {settings.key} in templates (scalars only)
- Full dict access via settings['key'] in code steps
- CLI: cmdforge settings <tool> show/edit/reset/diff
- GUI: Defaults editor in Tool Builder, Configure button on Tools page
- Registry: defaults.yaml published with tools, included in downloads
- Secret detection warning on publish (api_key, password, token, etc.)

Fully backward compatible - tools without defaults work unchanged.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

CHANGELOG.md

@@ -6,6 +6,35 @@ All notable changes to CmdForge will be documented in this file.
 
 ### Added
 
+#### Tool Settings Files
+- **Configurable tool settings**: Tools can now ship with default settings that users can customize
+  - `defaults.yaml` - Default settings published with the tool (immutable)
+  - `settings.yaml` - User's local overrides (auto-created from defaults on first use)
+  - Settings available in templates as `{settings.key}` (top-level scalars only)
+  - Settings available in code steps as `settings['key']` (full dict access)
+
+- **New CLI commands**:
+  - `cmdforge settings <tool> show` - View current settings
+  - `cmdforge settings <tool> edit` - Edit settings in $EDITOR
+  - `cmdforge settings <tool> reset` - Reset settings to defaults
+  - `cmdforge settings <tool> diff` - Show differences from defaults
+
+- **GUI support**:
+  - Tool Builder: New "Defaults (Optional)" collapsible section for defining default settings
+  - Tools Page: "Configure" button for tools with settings
+  - Settings Dialog: Edit tool settings with defaults reference panel
+
+- **Registry integration**:
+  - `defaults.yaml` is published alongside `config.yaml` and `README.md`
+  - `defaults` field added to registry API (publish, download, info endpoints)
+  - Size limit: 64KB for defaults content
+  - Secret detection warning on publish (warns about api_key, password, token, etc.)
+
+- **Automatic settings creation**:
+  - `ensure_settings()` helper copies defaults.yaml to settings.yaml when missing
+  - Called on tool load, save, and registry install for consistency
+  - Fully backward compatible - tools without defaults work unchanged
+
 #### Transitive Dependency Resolution
 - **Full transitive dependency resolution**: When installing dependencies, CmdForge now resolves and installs the complete dependency tree
   - `DependencyGraph` and `DependencyNode` dataclasses for structured dependency tracking