e621 credentials: user fields, API endpoint, Account screen

Backend:
- User model gains e621_username / e621_api_key / e621_base_url
- GET/PUT /api/auth/e621/ for the owner's credentials; /me exposes only
  the username and a configured flag, never the key

Frontend:
- e621 client core: Basic auth, _client param (browsers cannot set a
  User-Agent), serialized queue throttled to 1 request/second, readable
  error mapping
- Account screen (/account): username, API key with reveal toggle,
  base URL (e621 / e926 / custom), Save + Test connection
- Credentials are fetched from the backend and held in memory only,
  cleared on logout

backend/apps/accounts/views.py

@@ -4,7 +4,11 @@ from rest_framework.permissions import AllowAny, IsAuthenticated
 from rest_framework.response import Response
 from rest_framework.views import APIView
 
-from .serializers import RegisterSerializer, UserSerializer
+from .serializers import (
+    E621CredentialsSerializer,
+    RegisterSerializer,
+    UserSerializer,
+)
 
 
 class RegisterView(APIView):
@@ -35,3 +39,35 @@ class LogoutView(APIView):
         if request.auth:
             request.auth.delete()
         return Response(status=status.HTTP_204_NO_CONTENT)
+
+
+class E621CredentialsView(APIView):
+    """Store the e621 credentials used by the user's browser to call e621 directly."""
+
+    permission_classes = [IsAuthenticated]
+
+    def _payload(self, user):
+        return {
+            "username": user.e621_username,
+            "api_key": user.e621_api_key,
+            "base_url": user.e621_base_url,
+            "configured": user.e621_configured,
+        }
+
+    def get(self, request):
+        return Response(self._payload(request.user))
+
+    def put(self, request):
+        serializer = E621CredentialsSerializer(data=request.data)
+        serializer.is_valid(raise_exception=True)
+        data = serializer.validated_data
+        user = request.user
+        user.e621_username = data["username"].strip()
+        user.e621_api_key = data["api_key"].strip()
+        user.e621_base_url = (
+            (data.get("base_url") or "https://e621.net").strip().rstrip("/")
+        )
+        user.save(
+            update_fields=["e621_username", "e621_api_key", "e621_base_url"]
+        )
+        return Response(self._payload(user))