fix(admin): address follow-up Copilot findings on the prior fixes

- loadAdminProviders now validates against a stored-shape schema where
  secrets are plain strings, so a hand-edited ADMIN_PROVIDERS holding an
  {isSet} marker is dropped instead of later crashing maskSecret().
- loadSettings guards against array values (typeof [] === 'object'),
  which would otherwise overlay numeric keys onto process.env.
- Admin SecretInput uses the bare id so the shared component's
  <Label htmlFor> stays associated (only one ProviderDetail mounts).
- Add tests: marker-secret rejection, array-values guard, bedrock
  multi-secret round-trip.

tests/unit/admin-settings.test.ts

@@ -57,13 +57,22 @@ describe("loadSettings", () => {
         expect(loadSettings()).toEqual({ GOOD: "ok" })
     })
 
-    it("returns empty object when values is null or an array", () => {
+    it("returns empty object when values is null", () => {
         fs.writeFileSync(
             process.env.SETTINGS_FILE!,
             JSON.stringify({ version: 1, values: null }),
         )
         expect(loadSettings()).toEqual({})
     })
+
+    it("returns empty object when values is an array (no numeric keys)", () => {
+        fs.writeFileSync(
+            process.env.SETTINGS_FILE!,
+            JSON.stringify({ version: 1, values: ["a", "b"] }),
+        )
+        // Without the Array.isArray guard this would yield { "0": "a", ... }
+        expect(loadSettings()).toEqual({})
+    })
 })
 
 describe("applyToEnv / saveSettings", () => {