fix(admin): address follow-up Copilot findings on the prior fixes

- loadAdminProviders now validates against a stored-shape schema where
  secrets are plain strings, so a hand-edited ADMIN_PROVIDERS holding an
  {isSet} marker is dropped instead of later crashing maskSecret().
- loadSettings guards against array values (typeof [] === 'object'),
  which would otherwise overlay numeric keys onto process.env.
- Admin SecretInput uses the bare id so the shared component's
  <Label htmlFor> stays associated (only one ProviderDetail mounts).
- Add tests: marker-secret rejection, array-values guard, bedrock
  multi-secret round-trip.

app/[lang]/admin/models-section.tsx

@@ -182,8 +182,10 @@ function ProviderDetail({
                 disabled={disabled}
                 onChange={(field, value) => onUpdate({ [field]: value })}
                 renderSecret={({ field, id }) => (
+                    // Bare id keeps the shared component's <Label htmlFor={id}>
+                    // associated; only one ProviderDetail is mounted at a time.
                     <SecretInput
-                        id={`${id}-${provider.id}`}
+                        id={id}
                         keepOnEmpty
                         value={provider[field]}
                         disabled={disabled}