fix(httpapi): refuse config-to-secret for values that embed a reference (#1782)

## Bug

`POST /api/v1/servers/{id}/config-to-secret` refuses to convert a value
that is already a reference, but the check is `strings.HasPrefix(value,
"${keyring:") || strings.HasPrefix(value, "${env:")`. Two kinds of
values get past it:

- a `${file:/path}` reference (the provider added in #1717);
- a composite value with an embedded reference, such as the documented
`"Authorization": "Bearer ${keyring:github-token}"`
(`docs/features/keyring-integration.md`).

For these values the handler stores the literal text in the keyring and
rewrites the field to `${keyring:<secret_name>}`. Secret expansion runs
once, so on the next connect the upstream gets the unresolved text, for
example `Bearer ${keyring:github-token}` or
`${file:/run/secrets/github-token}`, as its credential.

The API masks both values on the read path because `IsConfigReference`
only passes through an exact `${keyring:..}` or `${env:..}` value. The
UI therefore shows them as plain secrets and offers Convert-to-secret.

## Trigger

```json
"headers": {"Authorization": "Bearer ${keyring:github-token}"}
```

`POST /api/v1/servers/<name>/config-to-secret` with
`{"scope":"header","key":"Authorization","secret_name":"gh2"}` succeeds.
After that, the header sent upstream is the literal `Bearer
${keyring:github-token}`.

## Fix

Use `secret.IsSecretRef(value)`, which matches any `${type:name}`
reference anywhere in the value. The handler then returns the existing
400 "already a reference" error for these values.

## Test

Two cases added to `TestHandleConvertConfigToSecret_ValidationErrors`:
an env value `${file:/run/secrets/github-token}` and a header `Bearer
${keyring:github-token}`. Both must be rejected with 400 before the
resolver is called.

## Commands run

- `CGO_ENABLED=0 go test -count=1 ./internal/httpapi`: ok
- With `server.go` reverted, both new cases fail (`expected: 400,
actual: 500`). The handler gets past validation and reaches the
resolver, which the mock leaves nil.
- `go vet ./internal/httpapi`, `gofmt -l internal/httpapi/`: clean

---------

Co-authored-by: Algis Dumbris <a.dumbris@gmail.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Author: 3 people

internal/httpapi/patch_server_test.go

@@ -412,11 +412,12 @@ func TestHandleConvertConfigToSecret_ValidationErrors(t *testing.T) {
 	logger := zap.NewNop().Sugar()
 
 	cases := []struct {
-		name       string
-		existing   *config.ServerConfig
-		body       string
-		wantStatus int
-		wantInBody string
+		name          string
+		existing      *config.ServerConfig
+		body          string
+		wantStatus    int
+		wantInBody    string
+		wantNotInBody string
 	}{
 		{
 			name:       "missing scope",
@@ -476,6 +477,37 @@ func TestHandleConvertConfigToSecret_ValidationErrors(t *testing.T) {
 			wantStatus: 400,
 			wantInBody: "already a reference",
 		},
+		{
+			name: "value is already a file reference",
+			existing: &config.ServerConfig{
+				Name: "synapbus", Protocol: "stdio", Enabled: true,
+				Env: map[string]string{"GITHUB_TOKEN": "${file:/run/secrets/github-token}"},
+			},
+			body:       `{"scope": "env", "key": "GITHUB_TOKEN", "secret_name": "synapbus-auth"}`,
+			wantStatus: 400,
+			wantInBody: "already a reference",
+		},
+		{
+			name: "value embeds a keyring reference",
+			existing: &config.ServerConfig{
+				Name: "synapbus", Protocol: "http", Enabled: true,
+				Headers: map[string]string{"Authorization": "Bearer ${keyring:github-token}"},
+			},
+			body:       `{"scope": "header", "key": "Authorization", "secret_name": "synapbus-auth"}`,
+			wantStatus: 400,
+			wantInBody: "already a reference",
+		},
+		{
+			name: "mixed value does not echo the literal part",
+			existing: &config.ServerConfig{
+				Name: "synapbus", Protocol: "stdio", Enabled: true,
+				Env: map[string]string{"DATABASE_URL": "postgres://app:hunter2@${env:DB_HOST}/app"},
+			},
+			body:          `{"scope": "env", "key": "DATABASE_URL", "secret_name": "synapbus-db"}`,
+			wantStatus:    400,
+			wantInBody:    "already a reference",
+			wantNotInBody: "hunter2",
+		},
 		{
 			name: "empty value",
 			existing: &config.ServerConfig{
@@ -504,6 +536,9 @@ func TestHandleConvertConfigToSecret_ValidationErrors(t *testing.T) {
 
 			require.Equal(t, tc.wantStatus, w.Code, "body=%s", w.Body.String())
 			require.Contains(t, w.Body.String(), tc.wantInBody)
+			if tc.wantNotInBody != "" {
+				require.NotContains(t, w.Body.String(), tc.wantNotInBody)
+			}
 			// The update path must not have been invoked when validation
 			// rejects the request.
 			assert.Nil(t, mockCtrl.capturedUpdates, "validation errors must not call UpdateServer")

internal/httpapi/server.go

@@ -3169,8 +3169,8 @@ func (s *Server) handleConvertConfigToSecret(w http.ResponseWriter, r *http.Requ
 		s.writeError(w, r, http.StatusBadRequest, fmt.Sprintf("%s %q has no value to store", req.Scope, req.Key))
 		return
 	}
-	if strings.HasPrefix(value, "${keyring:") || strings.HasPrefix(value, "${env:") {
-		s.writeError(w, r, http.StatusBadRequest, fmt.Sprintf("%s %q is already a reference (%s); nothing to convert", req.Scope, req.Key, value))
+	if secret.IsSecretRef(value) {
+		s.writeError(w, r, http.StatusBadRequest, fmt.Sprintf("%s %q is already a reference; nothing to convert", req.Scope, req.Key))
 		return
 	}