Add tool settings files for configurable tool defaults

Tools can now ship with defaults.yaml containing configurable settings
that users can customize via settings.yaml (auto-created from defaults).

Features:
- ensure_settings() helper copies defaults to settings on first use
- Settings available as {settings.key} in templates (scalars only)
- Full dict access via settings['key'] in code steps
- CLI: cmdforge settings <tool> show/edit/reset/diff
- GUI: Defaults editor in Tool Builder, Configure button on Tools page
- Registry: defaults.yaml published with tools, included in downloads
- Secret detection warning on publish (api_key, password, token, etc.)

Fully backward compatible - tools without defaults work unchanged.

Co-Authored-By: Claude Opus 4.5 <[email protected]>

olddocs/DESIGN.md

@@ -96,6 +96,40 @@ Steps execute in order. Each step's `output_var` becomes available to subsequent
 - `{input}` - Always available, contains stdin or input file content (empty string if no input)
 - `{variable_name}` - From arguments (e.g., `{max}`)
 - `{output_var}` - From previous steps (e.g., `{response}`, `{processed}`)
+- `{settings.key}` - From tool's settings file (top-level scalars only in templates)
+
+### Tool Settings
+
+Tools can ship with configurable settings via `defaults.yaml`:
+
+```yaml
+# ~/.cmdforge/mytool/defaults.yaml
+backend: piper
+endpoint: http://localhost:5001
+api_key: ''  # User fills in
+```
+
+When a tool with `defaults.yaml` is first loaded, `settings.yaml` is auto-created as a copy. Users edit `settings.yaml` to customize; `defaults.yaml` remains unchanged.
+
+**In templates** (scalars only):
+```yaml
+prompt: "Using {settings.backend} at {settings.endpoint}"
+```
+
+**In code steps** (full access):
+```python
+endpoint = settings.get('endpoint')
+api_key = settings['api_key']
+nested = settings['options']['timeout']  # Nested access works
+```
+
+**CLI commands:**
+```bash
+cmdforge settings mytool show    # View settings
+cmdforge settings mytool edit    # Edit in $EDITOR
+cmdforge settings mytool reset   # Reset to defaults
+cmdforge settings mytool diff    # Show changes
+```
 
 ### Output Variables