feat(backend): encrypt exchange credentials, remove IS_DEMO_MODE

- Fernet encrypt qd_exchange_credentials via SECRET_KEY (cryptography)

- Remove global read-only demo middleware; drop is_demo from auth payloads

- Egress whitelist: /api/credentials/egress-ip returns ipv4 + ipv6 (ipify)

- Exchange factory: demo/testnet URLs and OKX simulated-trading header

- Bitget spot connection test; misc route/service fixes

Made-with: Cursor

backend_api_python/app/routes/settings.py

@@ -134,6 +134,14 @@ CONFIG_SCHEMA = {
                 ],
                 'description': 'Select your preferred LLM provider'
             },
+            {
+                'key': 'AI_CODE_GEN_MODEL',
+                'label': 'Code Generation Model',
+                'type': 'text',
+                'default': '',
+                'required': False,
+                'description': 'Optional model override for AI code generation. If empty, uses provider default model'
+            },
             # OpenRouter
             {
                 'key': 'OPENROUTER_API_KEY',