fix(settings): mask credentials on the raw store and the suggestion list - #306

The hi-fi work taught the module-settings editor to hide credentials by value
as well as by name — `embeds_credential` marks a DSN with a password in its
authority as secret, and `_module_settings` masks value, default and env
reading on that rule. The other two screens showing the same data never got it.

`SettingService._out` masked only exact matches against `SENSITIVE_KEYS`, a
single-entry frozenset holding `host.secret_key`. So an override named
`users.smtp_password`, or any override holding a `postgresql://user:pw@host/db`,
rendered in clear text in the browse table and pre-filled into the edit form for
anyone holding `settings.view`. And `known_keys._from_definition` hard-coded
`is_secret: False` and passed `definition.default` straight through, where its
sibling `_from_field` masks it — inert only because no registry declaration
ships a credential default today.

Lift the shared rule into `_secrets` as `is_named_secret` / `conceals_secret`,
and run all three read paths through it. The store's placeholder-echo guard now
keys on whether the stored row is masked rather than on the one allowlisted
key, so saving an untouched form still leaves the real value alone — on every
credential row, not just `host.secret_key`.

Four smaller things in the same area:

- `embeds_credential` walks lists and dict values. A `list[str]` of broker URLs
  holds the same material as the bare string; returning False for anything
  non-`str` would have shown one in full.
- `_strip_mask_sentinels` takes the set of fields the editor actually rendered
  masked. Keying on the sentinel alone silently dropped the write on any field
  whose real value happened to be eight bullets.
- `known_keys` no longer ships `module` and `description`. Both are declared on
  the `KnownKey` interface and neither is rendered.
- The store's `page`/`per_page` are typed `int` with a `BeforeValidator` that
  substitutes the default. A bookmarked `?page=banana` still renders rather
  than 422ing, but the OpenAPI schema stops advertising page numbers as strings.

Closes #293

CI caught what the settings-only test run did not: masking in
``SettingService._out`` reaches every consumer of the service, and two of them
are not screens.

``SettingsStore`` is what applies overrides to the live settings objects at
boot, so a masked read wrote ``"********"`` over each stored credential —
which turned up as five ``users`` auth-screen failures, a
``reset_password_token_secret`` that no longer verified the tokens it had
signed. And ``SettingsAccessor.get`` — the documented read path other modules
use — would have handed a module the placeholder instead of its own API key.

Split the two readings of a row. ``list_by_scope_unmasked`` serves the store,
and ``get_resolved_value`` reads the entity directly; both are spelled out
rather than reached by a flag, so every caller that sees through the mask is
one grep away. ``resolve`` still returns the masked view, because that is what
``/api/settings/resolve`` renders.