fix(admin): address follow-up Copilot findings on the prior fixes

- loadAdminProviders now validates against a stored-shape schema where
  secrets are plain strings, so a hand-edited ADMIN_PROVIDERS holding an
  {isSet} marker is dropped instead of later crashing maskSecret().
- loadSettings guards against array values (typeof [] === 'object'),
  which would otherwise overlay numeric keys onto process.env.
- Admin SecretInput uses the bare id so the shared component's
  <Label htmlFor> stays associated (only one ProviderDetail mounts).
- Add tests: marker-secret rejection, array-values guard, bedrock
  multi-secret round-trip.

lib/admin/settings.ts

@@ -33,11 +33,14 @@ export function loadSettings(): Record<string, string> {
         // hold null/arrays/numbers that would otherwise be overlaid onto
         // process.env and coerce to junk like "[object Object]".
         const values: Record<string, string> = {}
-        const raw_values =
-            parsed && typeof parsed.values === "object" && parsed.values
+        const rawValues =
+            parsed &&
+            typeof parsed.values === "object" &&
+            parsed.values &&
+            !Array.isArray(parsed.values)
                 ? parsed.values
                 : {}
-        for (const [key, value] of Object.entries(raw_values)) {
+        for (const [key, value] of Object.entries(rawValues)) {
             if (typeof value === "string") values[key] = value
         }
         cachedSettings = values