feat: Hide secrets on api and channels

web/lib/api.ts

@@ -102,6 +102,25 @@ export interface Rollup {
 
 export type ChannelType = "webhook" | "smtp" | "discord" | "slack" | "telegram";
 
+/**
+ * What a channel's secret config values read as over the API. Writing it back
+ * unchanged preserves the stored credential; anything else, including "", is
+ * written verbatim.
+ *
+ * Mirrors `models.RedactedSecret` and `models.channelSecretKeys` in
+ * `server/internal/models/channel.go` — change both in the same commit, the
+ * same hazard as the mirrored token blocks.
+ */
+export const REDACTED_SECRET = "••••••••";
+
+export const CHANNEL_SECRET_FIELDS: Record<ChannelType, string[]> = {
+    webhook: ["url"],
+    slack: ["url"],
+    discord: ["url"],
+    telegram: ["token"],
+    smtp: ["password"],
+};
+
 export interface NotificationChannel {
     channel_id: string;
     name: string;