feat(18-01): write-only settings secrets, richeditor and tabs on settings forms (task 3)

- type: password on a settings form binds a lagoon.Encrypted column as a
  write-only secret (any other column fails boot naming the field): the
  GET omits it from data and reports stored, env or empty per field in
  meta.secrets; on PUT an absent key or "" keeps the value, null clears
  it, a non-string is a 422; the answer never carries a value
- cabana.SecretFallbacks (field to config key) gives the env state;
  cabana.SettingsMeta, SecretStored/SecretEnv/SecretEmpty exported
- settings forms accept richeditor: the Put sanitizes through seaglass
  like a controller save and returns meta.notices; repeater and
  dependsOn stay refused (settingsFormOnly next to controllerFormOnly)
- backend::lang secret.* phrases in en and pl
- admin SPA: PasswordField secret status line (stored with Remove stored
  value, env, empty, pending clear with Undo), SettingsFormView tabs with
  error-tab activation and the secrets/notices meta, settings payload
  that never sends an untouched secret; regenerated OpenAPI and TS
  types; rebuilt dist
- vault fixture, TestSettingsSecretCompile, Docker TestSettingsSecretSmoke
  and TestSettingsRichEditorSmoke, conform settings fixture with a
  password field; settings.md sections, forms.md notes, cabana README

admin/openapi/admin.json

@@ -2611,6 +2611,25 @@
                 ],
                 "type": "object"
             },
+            "cabana.SettingsMeta": {
+                "properties": {
+                    "notices": {
+                        "description": "Notices are what the seaglass sanitizer removed from richeditor\nvalues on this save.",
+                        "items": {
+                            "$ref": "#/components/schemas/cabana.FieldNotice"
+                        },
+                        "type": "array"
+                    },
+                    "secrets": {
+                        "additionalProperties": {
+                            "type": "string"
+                        },
+                        "description": "Secrets maps each password field to stored, env or empty.",
+                        "type": "object"
+                    }
+                },
+                "type": "object"
+            },
             "cabana.SettingsResult": {
                 "properties": {
                     "data": {
@@ -2619,6 +2638,9 @@
                     },
                     "exists": {
                         "type": "boolean"
+                    },
+                    "meta": {
+                        "$ref": "#/components/schemas/cabana.SettingsMeta"
                     }
                 },
                 "required": [
@@ -3647,6 +3669,7 @@
         },
         "/settings/{code}": {
             "get": {
+                "description": "The singleton's values keyed by field name. A write-only password field (a lagoon.Encrypted column) is never in data; meta.secrets reports its state instead: stored, env (empty column, the model's SecretFallbacks config key resolves) or empty. meta is omitted when the form has no password field.",
                 "parameters": [
                     {
                         "description": "Settings code",
@@ -3711,6 +3734,7 @@
                 ]
             },
             "put": {
+                "description": "Saves the singleton. For a password field an absent key or an empty string keeps the stored value and JSON null clears it; any other non-string value is a 422 on the field. A richeditor value is sanitized like a controller save and what was removed comes back in meta.notices. The answer carries meta.secrets with the new states and never the values.",
                 "parameters": [
                     {
                         "description": "Settings code",