Config document read API should always redact secret fields #31

This issue is a compliance shim for this repo's issue-first PR policy, not our primary work
tracker. Full tracking, diary, and decision history live on our internal ticket, TKT-323
(tickets.draugur.ai).

Ask

One of the config-document read endpoints did not apply the same secret-redaction the sibling
endpoint already applies to the same underlying config values. Fixed in the linked PR: every read
response on this API is now unconditionally redacted for secret-shaped fields (MCP server
credentials), with a corollary write-side guard against accidentally persisting the redaction
placeholder as a real value.