fix(security): harden system and temporary tool secrets

[FinleyGe]

Summary

• synchronize toolset system secrets from parent records and use the parent as the runtime authority
• clear temporary secret values when switching to system/team credentials, with server-side normalization
• keep production system secrets out of debug list, detail, and runtime flows
• add regression coverage for parent-child authority, debug fail-closed behavior, and app secret normalization

Validation

• 90 targeted tests passed across app, service, and global workspaces
• Prettier and git diff --check passed
• app typecheck is limited by the existing missing asset src/pageComponents/dashboard/skill/detail/Content.tsx:11

Scope

The system-secret plaintext-at-rest design remains out of scope for this PR.