- Fixed `ToolSecretsPanel` (`frontend/src/components/admin/system_settings/ToolSecretsPanel.tsx`) silently resetting the web search tool's `provider` to the hardcoded "brave" default on every save. The panel's local `provider` state now seeds from the persisted `PipelineSettings.componentSettings["tool:web_search"].provider` value (threaded down from `SystemSettings.tsx`) instead of unconditionally defaulting, so rotating an API key for an already-`tavily`-configured tool no longer clobbers it back to `brave`.
- Fixed `ToolSecretsPanel.handleSave` showing "Web search tool configured successfully" even when a superuser saves with a blank API key before the tool has ever been configured — the mutation now short-circuits with an error toast in that case, matching the existing `handleSaveSecrets` guard for Component Secrets.
