AI assist: explain-this-query / fix-this-error (one backend)

Supporting feature, not the headline. In-context actions on the current query/error with schema context; ONE backend first (key via env, same indirection pattern as DSN secrets); abstraction layer only if a second backend earns it. NL->SQL chat panel stays out (agents own agentic SQL via `dbui mcp`).

**Acceptance:** explain + fix actions work offline-gracefully (clear error when unconfigured); no key ever written to config plaintext.

The issue names no files or tests. Start by locating the existing DSN-secret indirection and the entry points for current-query and error actions; then verify explain and fix behavior with the chosen backend, including offline or unconfigured errors and ensuring keys are never written to plaintext config.

Written by the indexing model from the issue text.