Read API credential decrypt password from body instead of query string

Keeps the credential decryption secret out of the URL, so it no longer lands in web-server access logs, proxy logs, or browser history. credentials/read.php now reads api_key_decrypt_password from the request body, matching create/update. Consumers reading decrypted credentials must send it in the body, not the query string.

admin/modals/api/api_key_add.php

@@ -6,6 +6,7 @@ $key = randomString(32);
 $decryptPW = randomString(32);
 
 ob_start();
+
 ?>
 
 <div class="modal-header bg-dark">