API mode login does not persist across a page refresh

API (access key / secret key) login does not survive a page refresh. After signing in with API mode the app works normally, but reloading the page returns to the login screen.

## Why it happens

Three independent reasons, all verified in the current code:

1. **API mode is stateless by design.** It signs every request with the keypair and never creates a server session — there is nothing on the server to restore. (Confirmed by the team's own SESSION vs API comparison in the session-max-count thread: `client.login()` not called, `check_login()` not called, server session: none.)
1. **The keypair is never persisted.** `backendaiwebui.login.api_key` / `backendaiwebui.login.secret_key` are **removed** in two places (`react/src/components/LoginView.tsx` `clearSavedLoginInfo`, `react/src/helper/loginSessionAuth.ts`) and written **nowhere** in the repository. The credentials live only in memory, so a reload drops them.
1. **There is no restore path for non-SESSION modes.** `checkLogin` (`react/src/components/LoginView.tsx:1001`) only attempts `client.check_login()` when `connectionMode === 'SESSION'`; for any other mode it returns `false` immediately.

Secondary: `connectionMode` itself is reset from config on boot (`LoginView.tsx:224`), so in a deployment with `allowChangeSigninMode = true` a refresh also drops the user back to the configured default mode.

## Reproduce

1. Set `allowChangeSigninMode = true` in `config.toml`.
1. On the login screen pick **API**, enter a reachable **manager** endpoint plus an access key / secret key, and sign in — the app loads and GraphQL calls succeed.
1. Refresh the page → back to the login screen.

## What to decide

Persisting an access key / secret key in browser storage is a security decision, not an obvious fix. Options, in the order they should be considered:

- State plainly in the UI that API-mode sign-in does not persist across reloads (cheapest, no new risk).
- Offer opt-in persistence, scoped like the existing "Remember ID" (which deliberately stores only an identifier, never a secret).
- Give API mode a real restore path.

## Notes

Unrelated to the login redesign in FR-3560 — `loginSessionAuth.ts` and `packages/backend.ai-client/` have no diff on that branch, and the `LoginView.tsx` diff does not touch `clearSavedLoginInfo` or `checkLogin`.

JIRA Issue: FR-3561

Start with react/src/components/LoginView.tsx, especially clearSavedLoginInfo, checkLogin, and the connectionMode initialization, then inspect react/src/helper/loginSessionAuth.ts. Confirm the current API-mode persistence and restore behavior, and use the listed security options to define the selected solution and its completion criteria.

Written by the indexing model from the issue text.