Secrets stay in Secret Manager

API keys and library credentials are never entered in the browser. Status fields are read-only projections.

Integration health (stub)