feat(backend): encrypt exchange credentials, remove IS_DEMO_MODE

- Fernet encrypt qd_exchange_credentials via SECRET_KEY (cryptography)

- Remove global read-only demo middleware; drop is_demo from auth payloads

- Egress whitelist: /api/credentials/egress-ip returns ipv4 + ipv6 (ipify)

- Exchange factory: demo/testnet URLs and OKX simulated-trading header

- Bitget spot connection test; misc route/service fixes

Made-with: Cursor

backend_api_python/app/services/llm.py

@@ -147,6 +147,13 @@ class LLMService:
         
         return PROVIDER_CONFIGS[p]["default_model"]
 
+    def get_code_generation_model(self, provider: LLMProvider = None) -> str:
+        """Get model for AI code generation; fallback to provider default when unset."""
+        model = os.getenv('AI_CODE_GEN_MODEL', '').strip()
+        if model:
+            return model
+        return self.get_default_model(provider)
+
     # Legacy properties for backward compatibility
     @property
     def api_key(self):