fix(admin): mask all stored configuration secrets and credential URLs

apps/web/src/test/fakeApi.ts

@@ -90,7 +90,8 @@ export function fakeApi(initial: FakeUser[]) {
     { key: 'GITEA_TOKEN', group: 'api', type: 'string', secret: true, readonly: false, effective: '••••••••', env: null, local: '••••••••', default_value: '', source: 'local' },
   ];
   const serverConfig = () => ({ revision: String(configRevision), restart_required: configPending, entries: configEntries.map((entry) => {
-    const local = configValues[entry.key] ?? entry.local;
+    const rawLocal = configValues[entry.key] ?? entry.local;
+    const local = entry.secret && rawLocal ? '••••••••' : rawLocal;
     return { ...entry, local, effective: entry.env ?? local ?? entry.default_value, source: entry.env !== null ? 'env' : local !== null ? 'local' : 'default' };
   }) });
   const me = (u: FakeUser): Me => ({