Add tool settings files for configurable tool defaults

Tools can now ship with defaults.yaml containing configurable settings
that users can customize via settings.yaml (auto-created from defaults).

Features:
- ensure_settings() helper copies defaults to settings on first use
- Settings available as {settings.key} in templates (scalars only)
- Full dict access via settings['key'] in code steps
- CLI: cmdforge settings <tool> show/edit/reset/diff
- GUI: Defaults editor in Tool Builder, Configure button on Tools page
- Registry: defaults.yaml published with tools, included in downloads
- Secret detection warning on publish (api_key, password, token, etc.)

Fully backward compatible - tools without defaults work unchanged.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

README.md

@@ -164,6 +164,12 @@ cmdforge add owner/tool               # Add tool as dependency
 cmdforge install                      # Install all dependencies
 cmdforge deps                         # Check dependency status
 
+# Tool Settings
+cmdforge settings mytool show         # View tool settings
+cmdforge settings mytool edit         # Edit in $EDITOR
+cmdforge settings mytool reset        # Reset to defaults
+cmdforge settings mytool diff         # Show changes from defaults
+
 # Configuration
 cmdforge config show                  # Show current config
 cmdforge config connect username      # Connect to registry account
@@ -416,6 +422,54 @@ See [Meta-Tools Design](docs/reference/meta-tools.md) for full documentation.
 | `{input}` | The piped/file input |
 | `{argname}` | Custom argument value |
 | `{output_var}` | Output from previous step (prompt, code, or tool) |
+| `{settings.key}` | Value from tool's settings file (scalars only) |
+
+### Tool Settings
+
+Tools can ship with configurable settings that users can customize without editing the tool itself:
+
+```
+~/.cmdforge/tts/
+├── config.yaml       # Tool definition (published)
+├── defaults.yaml     # Default settings (published with tool)
+├── settings.yaml     # User's customized settings (auto-created, not published)
+└── README.md         # Documentation
+```
+
+**Creating a tool with settings:**
+
+```yaml
+# defaults.yaml - ships with your tool
+backend: piper
+endpoint: http://localhost:5001
+api_key: ''  # User fills in their own key
+voice: default
+```
+
+**Using settings in steps:**
+
+```yaml
+# In a prompt step (top-level scalars only)
+prompt: "Using {settings.backend} at {settings.endpoint}"
+
+# In a code step (full access)
+code: |
+  endpoint = settings.get('endpoint')
+  api_key = settings['api_key']
+  if not api_key:
+      raise ValueError("Please set api_key in settings")
+```
+
+**Managing settings via CLI:**
+
+```bash
+cmdforge settings tts show        # View current settings
+cmdforge settings tts edit        # Edit in $EDITOR
+cmdforge settings tts reset       # Reset to defaults
+cmdforge settings tts diff        # Show changes from defaults
+```
+
+Settings are fully optional - tools without a `defaults.yaml` work exactly as before.
 
 ## Project Dependencies