[agentHits]

What is this PR about?

A stored secret could be reused with a destination chosen by the caller. Update and test procedures refill the stored secret when the request carries the masked placeholder (or leaves the secret blank/omitted), but they took endpoint, host and username fields from the request. A user who can edit a record but cannot read its secret could point it at a host they control and capture the secret.

New rule, enforced by a shared helper assertStoredSecretTargetUnchanged (packages/server/src/utils/security/redaction.ts): when the request keeps the stored secret, every endpoint/host/username field must equal the stored value; otherwise the request fails with BAD_REQUEST "Re-enter the to change ".

• Vault providers: mergeVaultProviderConfig (used by update and testConnection) binds kept credentials to url / siteUrl + clientId / region + endpoint + accessKeyId / vaultUri + tenantId + clientId / apiUrl. AWS and AWS Parameter Store accessKeyId is now masked as well.
• Registries: updateRegistry no longer runs docker login with the stored password against a new registryUrl or username. organizationId is removed from apiUpdateRegistry.
• Notifications: email (smtpServer, smtpPort, username with the stored password), Gotify (serverUrl with the stored app token), ntfy (serverUrl with the stored access token), custom (endpoint while stored header values are kept). updateEmail now passes the TRPCError message through instead of a generic one.
• AI settings: a stored apiKey cannot be sent to a new apiUrl.
• GitLab / Gitea: changing the URL, internal URL or client/application id requires entering the secret again. A URL change also clears the stored OAuth tokens, so the provider has to be authorized again. The GitLab edit form gets an optional "Application Secret" field for this (the Gitea form already asks for the client secret on every save).
• DNS providers: Route53 accessKeyId and Porkbun apiKey are masked; the placeholder is restored on update and test as before.

What changes for users:

• Owners/admins: editing names, flags, topics, recipients and other non-target fields works as before with the masked placeholder. Changing an address, username or region of an existing record now needs the secret again (clear error message). GitLab/Gitea need re-authorization after a URL change.
• Members with update rights: can no longer redirect stored credentials to their own host.

The S3 destination router is not touched here.

Checks

• CI=true bunx vitest run --config __test__/vitest.config.ts on the 7 new/changed test files: 45 passed.
• Related folders (env, dns, registry, notification, ai, security, settings, permissions, Git providers): 68 files, 785 passed.
• All 28 new/changed tests fail against the origin/AgentHits-Dev sources (checked by temporarily restoring the source files with git checkout origin/AgentHits-Dev -- <files>).
• Full suite: 237 files passed; only application.real.test.ts fails locally (no Docker socket), as expected.
• bun run typecheck: exit 0.
• bunx biome check on the 18 changed files: 0 errors.

Rollout notes

• No migrations.
• After deploy, editing a vault provider, registry, notification, AI setting or GitLab/Gitea provider with a new address while keeping the stored secret returns BAD_REQUEST; re-enter the secret in the form.
• AWS/AWS Parameter Store vault providers and Route53/Porkbun DNS providers now show the key id as ********; saving the form unchanged keeps the stored value.

🤖 Generated with Claude Code