Fix 404 when removing all permissions from an API client

[edilsonacjr]

• When all permission checkboxes are unchecked on the API client edit form, the browser omits the api_client[permissions][] parameter entirely, causing params.require(:api_client) to raise ActionController::ParameterMissing and return a 404
• Added a hidden field to ensure the api_client parameter is always present in the form submission
• Filter out the blank hidden field value in the controller so the permissions array is clean

Test plan

• Go to /api_clients/:id for an existing API client with permissions
• Uncheck all permission checkboxes and click Update
• Verify the update succeeds and all permissions are removed
• Verify updating with some permissions checked still works as before