### Check for existing issues

- [X] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

`/search_tools/list` returns each tool's `litellm_params.api_key` masked (for example `sk****et`). The dashboard's search-tool edit modal pre-fills its form from that masked value, and the submit path always sends `litellm_params.api_key` back to `PUT /search_tools/{id}`. The backend stores the supplied `litellm_params` as-is, so saving an unchanged or metadata-only edit replaces the real provider credential with the masked placeholder string and breaks the search tool.

**Observed:** The edit form initializes `api_key` from the masked value returned by `/search_tools/list`. `handleEditSubmit` includes that masked value in the payload, and `update_search_tool_in_db` overwrites the stored `litellm_params` with whatever the request supplies. The real API key is replaced with the masked placeholder (for example `sk****et`), and the search tool stops working until a human re-enters the key.

**Expected:** A metadata-only edit should not modify the stored API key. If the user did not enter a new key, the backend should keep the previously stored sec…