docs(backup): say what the secret-key hints actually refuse (#2656)

The comment called the hint list belt-and-braces over keys the collector
already refuses to write. It is not: _collect_settings filters exactly
bambu_cloud_token and auth_secret_key, so a current backup really does
carry mqtt_password, ldap_bind_password, ha_token and prometheus_token,
and the hints are the only thing that refuses them. The companion-
credential rule sits downstream of that, so reading the list as redundant
and shortening it would write a stale credential and make that rule inert
at the same time.

Comment and test docstring only - no behaviour change.

backend/app/services/github_restore.py

@@ -72,8 +72,13 @@ _KPROFILE_PATH_RE = re.compile(r"^kprofiles/([^/]+)/([^/]+)\.json$")
 # contain them, and a restore must not resurrect a stale credential.
 _SENSITIVE_SETTING_KEYS = {"bambu_cloud_token", "auth_secret_key"}
 
-# Belt-and-braces for the same reason: any key that looks like a secret is
-# skipped even if it isn't in the explicit denylist above.
+# The primary refusal, not a backstop for the set above. The collector filters
+# exactly bambu_cloud_token and auth_secret_key, so every other credential —
+# mqtt_password, ldap_bind_password, ha_token, prometheus_token — is present in
+# a current backup and is skipped only because its key matches a hint here.
+# _COMPANION_CREDENTIALS sits downstream of that: it withholds a toggle when the
+# credential it needs was refused, so shortening this tuple would both write a
+# stale credential and quietly make that rule inert.
 _SECRET_KEY_HINTS = ("token", "secret", "password", "access_code", "api_key", "passphrase")
 
 # Settings the MQTT relay reads only when it is (re)configured, so restoring the

backend/tests/unit/test_github_restore.py

@@ -125,8 +125,9 @@ class TestSettingKeyBlocklist:
         Carving it out would also be a live hole rather than a tidy-up: an
         attacker-authored ``settings/app_settings.json`` could then get a
         ``*token*``-named row written simply by choosing that name. This
-        blocklist's whole job is belt-and-braces, so a name-shaped exception to
-        it is exactly the wrong shape of fix.
+        The hints are the primary refusal for every credential the collector
+        does not filter, so a name-shaped exception to them is exactly the wrong
+        shape of fix.
         """
         assert _is_blocked_setting_key("ha_token_from_env") is True