Add tool settings files for configurable tool defaults

Tools can now ship with defaults.yaml containing configurable settings
that users can customize via settings.yaml (auto-created from defaults).

Features:
- ensure_settings() helper copies defaults to settings on first use
- Settings available as {settings.key} in templates (scalars only)
- Full dict access via settings['key'] in code steps
- CLI: cmdforge settings <tool> show/edit/reset/diff
- GUI: Defaults editor in Tool Builder, Configure button on Tools page
- Registry: defaults.yaml published with tools, included in downloads
- Secret detection warning on publish (api_key, password, token, etc.)

Fully backward compatible - tools without defaults work unchanged.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

CLAUDE.md

@@ -42,6 +42,8 @@ cmdforge
 ### Key Paths
 
 - **Tools storage**: `~/.cmdforge/<toolname>/config.yaml`
+- **Tool defaults**: `~/.cmdforge/<toolname>/defaults.yaml` (optional, published with tool)
+- **Tool settings**: `~/.cmdforge/<toolname>/settings.yaml` (user overrides, auto-created from defaults)
 - **Wrapper scripts**: `~/.local/bin/<toolname>` (auto-generated bash scripts)
 - **Provider config**: `~/.cmdforge/providers.yaml`
 - **Collections storage**: `~/.cmdforge/collections/<name>.yaml`
@@ -65,8 +67,10 @@ Variables are passed between steps:
 - `{input}` - always available (stdin/file content)
 - `{argname}` - from tool arguments
 - `{step_output_var}` - from previous step's `output_var`
+- `{settings.key}` - from tool's settings.yaml (top-level scalars only in templates)
+- `settings['key']` - full dict access in code steps
 
-Variable substitution is simple string replacement in `runner.py:substitute_variables()`.
+Variable substitution is handled in `runner.py:substitute_variables()`. Settings are loaded from `settings.yaml` if it exists, otherwise an empty dict is used.
 
 ## Provider System