W1.1a — Strip openRouterImageApiKey from state-to-webview payload

[edelauna]

Context

Sub-issue of #1. Splits the secrets-cleanup work into two reviewable pieces.

openRouterImageApiKey flows through getStateToPostToWebview() as a raw string. Unlike the provider API keys in apiConfiguration, this field is only used to derive a boolean status (isConfigured = !!openRouterImageApiKey) in ImageGenerationSettings.tsx — the raw value is never needed in the renderer.

This is the simpler half: no settings-input UX changes required. It also establishes the boolean-presence pattern that W1.1b will apply more broadly.

Developer Notes

• In getStateToPostToWebview() (src/core/webview/ClineProvider.ts): replace openRouterImageApiKey (raw string) with openRouterImageApiKeyConfigured: !!openRouterImageApiKey.
• Update ExtensionState type in packages/types/src/ to reflect the new field name/type.
• In webview-ui/src/context/ExtensionStateContext.tsx: update the state shape and initial value.
• In webview-ui/src/components/settings/ImageGenerationSettings.tsx: change the openRouterImageApiKey?: string prop to openRouterImageApiKeyConfigured: boolean; derive isConfigured from the boolean directly.
• When the user types a new key in the settings input and saves, the value is posted back via the existing settings-save message — no change needed there.
• Files: src/core/webview/ClineProvider.ts, packages/types/src/, webview-ui/src/context/ExtensionStateContext.tsx, webview-ui/src/components/settings/ImageGenerationSettings.tsx, webview-ui/src/components/settings/ExperimentalSettings.tsx, webview-ui/src/components/settings/SettingsView.tsx.
• Validation: webview functions identically; unit test asserts the broadcast payload does not contain openRouterImageApiKey as a string field; isConfigured renders correctly for both configured and unconfigured states.