## 1. Secure persistence

- [x] 1.1 Add the encryption dependency and a testable Cloud Provider secret-box configuration backed by `CLOUD_LLM_PROVIDER_ENCRYPTION_KEY`.
- [x] 1.2 Add SQLAlchemy profile/settings rows and an Alembic migration after the current Cloud schema revision.
- [x] 1.3 Extend the Cloud repository contract and SQL implementation with profile CRUD, atomic activation, revision checks, and active-profile resolution.

## 2. Administrator management API

- [x] 2.1 Add non-secret Pydantic SDK request/response models and a dedicated `llm-providers:admin` scope.
- [x] 2.2 Add the authenticated, CSRF-protected Provider profile router with audit records and compose it into the Cloud API.
- [x] 2.3 Add focused repository and API tests for validation, encryption redaction, authorization, CSRF, revisions, activation, and retirement invariants.

## 3. Cloud planner resolution

- [x] 3.1 Allow runtime Anthropic and OpenAI clients to receive explicit API keys and an OpenAI-compatible base URL without changing direct transport behavior.
- [x] 3.2 Resolve the active database profile per planner request, remove Cloud API planner environment configuration, and use the resolved metadata for token accounting.
- [x] 3.3 Add planner route and client tests for database activation, fail-closed resolution, and OpenAI-compatible client construction.

## 4. Cloud Console

- [x] 4.1 Add Provider profile types and CSRF-aware client methods to the Cloud Console API layer.
- [x] 4.2 Add an administrator-only Provider management view with create, edit/key rotation, enable/disable, activate, and inactive-profile deletion workflows.
- [x] 4.3 Add Console tests for Provider API methods and permission-gated navigation/view behavior.

## 5. Documentation and validation

- [x] 5.1 Document encryption-key provisioning, required active-profile cutover, OpenAI-compatible configuration, removed planner environment variables, and rollback in Cloud deployment documentation.
- [x] 5.2 Run relevant backend tests, Console tests/build, format/lint, compile checks, and strict OpenSpec validation; resolve failures.

## 6. Anthropic custom base URL

- [x] 6.1 Allow Anthropic Provider profiles to validate and persist an optional custom base URL, and pass it to the Cloud planner client.
- [x] 6.2 Extend `AnthropicToolCallingClient` to construct the Anthropic SDK with an explicit base URL while preserving direct-transport defaults.
- [x] 6.3 Expose the Base URL field for Anthropic in the Cloud Console; add backend/runtime tests and update deployment/specification documentation.