fix: /config no longer shows secret options.

ADR.md

@@ -55,7 +55,7 @@ address is picked up at the next run of `vpn-router-setup`.
 
 ## ADR-3: /config is authenticated with a short-lived JWT signed with a shared secret
 
-Status: Accepted; amended by ADR-7
+Status: Accepted; amended by ADR-7 and ADR-8
 
 Context: A client such as manage-ui needs the configuration and the resolved state of the
 router, which `/` and `/status` must not show. The service has only the standard library, listens
@@ -174,3 +174,18 @@ setup is in, and follows a changed address, port or `web.enabled` within 30 seco
 restart. `web.json` no longer holds the address, the port or the secret, so the secret is only in
 `vpn-router.json`. A change of the secret applies to the next request. The interfaces are read
 every 30 seconds, which costs a few `ip` commands.
+
+## ADR-8: /config leaves secret options out
+
+Status: Accepted
+
+Context: `/config` showed the secret options of the configuration with their values replaced by
+`********`. That still tells a reader which secrets are set, and a secret has no use outside the
+router, so a client never needs it.
+
+Decision: The configuration that `vpn-router-setup` writes for the web service has no secret
+options at all. They are recognised by name as before: `psk`, and options with `secret`,
+`password`, `token` or a `_key` ending in the name.
+
+Consequences: No secret reaches the web service's state file or any answer of the API. A client
+cannot tell whether a secret is set. A new secret option still needs a name that matches.