fix: stop sending stored passwords and PIN back to clients

The settings routes returned the WiFi passphrase, MQTT password and the
login password and PIN in plain text, and the debug log printed them and
the API key. Responses now carry hasPassphrase/hasPassword/hasPin flags,
logs mask the values, and an omitted secret keeps the stored one.

The UI loads secret fields empty and treats a blank field as "keep" while
the SSID or username is unchanged. Clearing a secret without changing the
SSID or username is listed in docs/KNOWN_ISSUES.md.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/Secrets.h

@@ -0,0 +1,25 @@
+#ifndef secrets_h
+#define secrets_h
+#include <string.h>
+
+// Stored secrets (WiFi passphrase, MQTT password, login password/PIN) are
+// write-only: responses carry hasSecret() flags and logs carry maskSecret().
+
+inline bool hasSecret(const char *s) { return s && s[0] != '\0'; }
+
+inline const char *maskSecret(const char *s) { return hasSecret(s) ? "<set>" : "<empty>"; }
+
+// Updates dest from an incoming value, truncating to size.  A null incoming
+// value means the client left the field out, so the stored secret is kept.
+// Pass obj["key"].as<const char *>(), which is null when the key is absent.
+// Returns true when dest changed.
+inline bool applySecret(const char *incoming, char *dest, size_t size) {
+  if(!incoming || size == 0) return false;
+  size_t len = strlen(incoming);
+  if(len >= size) len = size - 1;
+  if(strncmp(dest, incoming, len) == 0 && dest[len] == '\0') return false;
+  memcpy(dest, incoming, len);
+  dest[len] = '\0';
+  return true;
+}
+#endif