security: API Key 改为仅存储在浏览器 localStorage，不再经过服务器

ui.js

@@ -89,11 +89,12 @@ function buildPayload() {
   const height = heightInput.value ? parseInt(heightInput.value) : undefined;
 
   const payload = {
-    model:          currentModel,
-    prompt:         promptInput.value.trim(),
-    aspect_ratio:   aspectRatio.value,
+    model:           currentModel,
+    prompt:          promptInput.value.trim(),
+    aspect_ratio:    aspectRatio.value,
     response_format: responseFormat.value,
-    n:              n,
+    n:               n,
+    apiKey:          localStorage.getItem('imgGen-apiKey') || '',
   };
 
   if (seed)              payload.seed              = seed;
@@ -179,11 +180,11 @@ async function copySrc(src, fmt, btn) {
 // ── Init ────────────────────────────────────────────────────────
 
 async function init() {
-  try {
-    const cfg = await api('/api/config');
-    if (!cfg.hasApiKey) apiKeyAlert.style.display = 'flex';
-    baseUrlInput.value = cfg.baseUrl || 'https://api.minimaxi.com';
-  } catch { /* non-fatal */ }
+  const savedKey = localStorage.getItem('imgGen-apiKey') || '';
+  const savedBaseUrl = localStorage.getItem('imgGen-baseUrl') || 'https://api.minimaxi.com';
+  if (!savedKey) apiKeyAlert.style.display = 'flex';
+  apiKeyInput.value = savedKey;
+  baseUrlInput.value = savedBaseUrl;
 }
 
 // ── Generate ────────────────────────────────────────────────────
@@ -269,17 +270,12 @@ saveSettingsBtn.addEventListener('click', async () => {
   clearError();
   const apiKey  = apiKeyInput.value.trim();
   const baseUrl = baseUrlInput.value.trim() || 'https://api.minimaxi.com';
-  try {
-    await api('/api/config', {
-      method:  'POST',
-      headers: { 'Content-Type': 'application/json' },
-      body:    JSON.stringify({ apiKey, baseUrl }),
-    });
-    if (apiKey) apiKeyAlert.style.display = 'none';
-    closeModal();
-  } catch (err) {
-    showError(err.message);
-  }
+
+  localStorage.setItem('imgGen-apiKey', apiKey);
+  localStorage.setItem('imgGen-baseUrl', baseUrl);
+
+  if (apiKey) apiKeyAlert.style.display = 'none';
+  closeModal();
 });
 
 // ── Theme switcher ─────────────────────────────────────────────