Handoff from the credential change on `r2/sec`, which landed
`secure::store_or_clear_project_secret` and left a `TODO` naming this
call site. `store_secrets_for_project` could only ever write: a token
blanked in the UI stayed in the keychain, `load_secrets_for_project` read
it straight back onto the project, and the container went on receiving a
credential the user had revoked.
**Not the mechanical switch the handoff describes, deliberately.** Every
secret field is `#[serde(skip_serializing)]`, so the project object the
frontend holds carries no `git_token` key at all — a save from the
Workspace, Runtime or Model section sends the field *absent*, while the
editor that owns it sends `git_token: null` when the user blanks it.
`Option<String>` maps both to `None`, so clearing on `None` would delete
every project secret each time an unrelated setting was changed.
`update_project` therefore takes the raw payload, records which secret
fields arrived as an explicit `null`, and clears exactly those; absent
still means "not mine to touch".
**This commit does not build on `r2/scrub` alone** — it calls
`secure::store_or_clear_project_secret`, which exists only on `r2/sec`.
Verified green against that file: 464 tests pass with `r2/sec`'s
`storage/secure.rs` in place.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
Claude
b49dddab45