The settings UI displays saved API keys masked with '•' (U+2022). Saving
a provider without retyping the key echoed that mask back, and the PUT
handler persisted it as the real credential. The masked key then flowed
into an Authorization/x-api-key header, throwing "Cannot convert argument
to a ByteString ... value 8226" at request time.
Treat masked values echoed back on update as "unchanged" so the stored
key is preserved, and reject masked values on create/probe. Add tests.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
f0d2415c20