Source credentials stay on the server

[WaylandYang]

Fixes #246.

Until now only auth_header was stripped from source responses; the object-storage, WebDAV and Notion keys went out to every viewer of the knowledge base, on listing as well as on create / update.

One list, four consumers. SOURCE_SECRET_KEYS in utopia-core (auth_header, token, password, secret_access_key, account_key, service_account_key) is used by the listing SQL (config - $2::text[]), by Source::without_secrets for the create / update responses, by the update merge (keep_secrets: blank or missing keeps the stored value, an explicit null removes it, a new value replaces), and the audit log records only whether the config changed. Identifiers stay visible (username, account_name, access_key_id, bucket): alone they authenticate nothing, and the UI needs them to say which account a source uses. Adding a connector means adding its keys to that list first.

Along the way: every source handler now confirms the source belongs to the KB in the path (source_in_kb). require_kb only checked the person's role on the KB; with a source id from another KB an editor could sync, clean up or delete it, and a viewer could read its sync runs. get_token already did this check; the rest now share it.

Tests: a_viewer_never_sees_a_credential inserts one source per connector with real key names and asserts the listing carries none of the secret keys while sources::get (the sync path) still has them all; unit tests cover the merge rule and the response masking.

0013 carries a revision note.

🤖 Generated with Claude Code