25b0d57a97
GET /api/conf no longer returns smtp.pass / oauth.jwtSecret in cleartext (masked to ********). POST treats a blank or ******** secret submission as "keep the stored value," so editing the From address or token lifetimes no longer requires re-entering or leaks the SMTP password / JWT secret. The /conf form fields carry a leave-unchanged hint. Storage stays in OpenBao at secret/sso-manager/conf (unchanged); no theta-suite policy change needed. Co-Authored-By: Claude <noreply@anthropic.com>