fix(settings): a plugin's password is sealed at rest, and a blank box keeps it (#5671)

The UniFi password sat in plugin.unifi in plain text: SECRET_KEYS covers
whole settings, and a plugin's settings are one dict. Saving the plugin's
settings page also wiped it, since the password box is never filled back
in and its blank value was stored.

- A plugin field whose name holds password, secret or token is a
  credential (is_plugin_secret). set_setting seals it inside the dict,
  every read opens it, startup seals any plaintext left from before, and
  the undecryptable-secrets banner names it as plugin.<name>.<field>.
- The settings page uses the same test for its password boxes, and a blank
  box keeps the saved value.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

steward/templates/settings/plugin_detail.html

@@ -108,10 +108,11 @@
         {% else %}
           <div class="form-group" style="margin:0;">
             <label style="font-size:0.82rem;">{{ field_label(cfg_key) }}</label>
-            <input type="{% if 'password' in cfg_key or 'secret' in cfg_key %}password{% else %}text{% endif %}"
+            {% set secret = is_plugin_secret(cfg_key) %}
+            <input type="{% if secret %}password{% else %}text{% endif %}"
                    name="plugin.{{ plugin._dir }}.{{ cfg_key }}"
-                   value="{% if 'password' in cfg_key or 'secret' in cfg_key %}{% else %}{{ plugin._config.get(cfg_key, cfg_default) }}{% endif %}"
-                   {% if 'password' in cfg_key or 'secret' in cfg_key %}placeholder="••••••••"{% endif %}>
+                   value="{% if secret %}{% else %}{{ plugin._config.get(cfg_key, cfg_default) }}{% endif %}"
+                   {% if secret %}autocomplete="new-password" placeholder="{{ 'kept; type to change' if plugin._config.get(cfg_key) else 'none saved' }}"{% endif %}>
           </div>
         {% endif %}