fix: hands-on bugs found during pre-submission audit

API + data integrity
- /api/settings GET no longer leaks the active Anthropic API key — returns a
  masked preview (sk-ant-XX…YYYY) plus a boolean `anthropic_api_key_set` flag
- /api/settings POST won't overwrite a real key with the masked placeholder
  the client receives back on GET (length<30 / "…" / "..." / "***" markers
  trigger a preserve-existing path)
- /api/best_result, /api/status, _make_run_dict, _result_to_dict, all AI-loop
  emits, validation_run_complete, optimization_complete, ai_iteration_complete,
  ai_targets_met, run_complete: max_drawdown and win_rate are now consistently
  emitted as PERCENTAGES (0–100), matching the dashboard's existing display
  formatters. They were previously emitted as fractions (0.13 = 13%) so the UI
  rendered "0.13%" instead of "13%"
- ResultRanker.make_result() now sets `passing` and `raw_score` on every result
  it produces. Previously these were only set during a full ranker.rank() pass,
  so individual Phase 2 / Phase 3 runs hit _make_run_dict with passing=False
  even when they cleared all gates (history showed "0 passing" when 22/22
  actually passed)

optimizer/result_ranker.py

@@ -165,7 +165,7 @@ class ResultRanker:
                 run_id=run_id, params=params, phase=phase,
                 error=error or "run_failed",
             )
-        return RankedResult(
+        result = RankedResult(
             run_id        = run_id,
             params        = params,
             phase         = phase,
@@ -176,3 +176,8 @@ class ResultRanker:
             max_drawdown  = getattr(metrics, "max_drawdown_pct", 0.0) or 0.0,
             total_trades  = getattr(metrics, "total_trades", 0) or 0,
         )
+        # Set passing + raw_score now so single-run dispatchers (Phase 2 AI loop,
+        # validation runs) get correct values without waiting for a full rank() pass.
+        result.passing   = self._is_passing(result)
+        result.raw_score = self._raw_score(result) if result.passing else 0.0
+        return result