feat(admin): /admin/integrations becomes the full infra-secrets panel — reveal, rotate, clear, alerting keys, live #5557

Owner ask: "do we have an infra secrets panel which we can reveal, edit, delete and rotate and also push through to the box." Partial yes became full yes:

• New "Alerting & reporting" group — MONITOR_ALERT_WEBHOOK_URL, EMAIL_PROVIDER, EMAIL_HTTP_URL/TOKEN, HEARTBEAT_REPORT_TOKEN, ESTATE_WATCH_URLS, REPORTING_EPOCH. These being env-file-only was exactly why alert-wiring sessions required SSH; every reader is a lazy process.env lookup, so values saved here apply immediately, no deploy — the pending wiring session is now a browser task.
• Reveal — per-secret button, audit row config.revealed. Reveal-with-audit beats reveal-never: the operator owns these values and pasting them at the other end is the job.
• Rotate — fields marked mintable (the heartbeat token) get a server-side 256-bit generate: stored, shown once, audit config.rotated. That's what rotation means for self-issued shared secrets; third-party keys deliberately can't be "rotated" here.
• Clear — deletes the row + unsets the live value (deleteConfigValue, new), audit config.cleared; button states that an env-file value returns on restart.
• All endpoints refuse keys outside INTEGRATION_FIELDS — no arbitrary env read/write surface.

Honest boundaries: DB values feed the app process; host-side scripts reading /opt/gluecron/.env are untouched. And for the risk register: system_config values are plaintext in Postgres — encryption-at-rest with a box-held master key is a named follow-up, not a silent gap.

Typecheck clean; design gate green; admin-integrations suite 10 pass (group list extended).