Use central Anthropic key for AI insights; add update-check banner

AI insights now fetches the Claude API key from the central settings
service instead of storing its own encrypted copy, so wages and other
apps can share the same key. Also wires up the update-available banner
using the existing version-check hook pattern.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

backend/jobs/ai_insights.py

@@ -17,6 +17,7 @@ from sqlalchemy import text
 from sqlalchemy.ext.asyncio import AsyncSession
 
 from database import AsyncSessionLocal
+from services.central_settings import get_anthropic_credentials
 
 logger = logging.getLogger(__name__)
 
@@ -533,10 +534,11 @@ async def generate_insight(db: AsyncSession, triggered_by: str = "scheduler") ->
     if config.get('ai_insights_enabled', 'false').lower() not in ('true', '1', 'yes'):
         return {"success": False, "error": "AI insights disabled"}
 
-    # Check API key
-    api_key = config.get('ai_insights_api_key')
+    # Check API key — managed centrally in Portal → Settings → Integrations, not app-local
+    anthropic_creds = await get_anthropic_credentials()
+    api_key = anthropic_creds.get('api_key') if anthropic_creds else None
     if not api_key:
-        return {"success": False, "error": "No API key configured"}
+        return {"success": False, "error": "Anthropic API key not configured — add it in Portal → Settings → Integrations"}
 
     model = config.get('ai_insights_model', DEFAULT_MODEL)
     budget = int(config.get('ai_insights_daily_token_budget', str(DEFAULT_DAILY_TOKEN_BUDGET)))