fix: fully redact custom credentials in key inventory

src/core/auth-keys.ts

@@ -207,7 +207,8 @@ export interface AuthKeyStatus {
 	info: AuthKeyInfo | null;
 	/** A key is present when EITHER the environment or the file has it. */
 	present: boolean;
-	/** The masked tail + character count, e.g. "…ab12 (64 chars)". */
+	/** Ordinary masked tail + count, e.g. "…ab12 (64 chars)"; custom keys
+	 * use full redaction, with no credential characters at any length. */
 	masked: string | null;
 	/** Where the live value comes from, given env-wins precedence. */
 	source: "env" | "file" | "none";

src/server/keys.ts

@@ -162,7 +162,9 @@ export function resolveKeyStatuses(
 			id,
 			info: AUTH_KEYS.find((k) => k.id === id) ?? null,
 			present: live !== undefined,
-			masked: live !== undefined ? `${maskKey(live)} (${live.trim().length} chars)` : null,
+			// Custom keys may be one character: even a masked suffix can expose
+			// the entire credential. Preserve inventory, return no key characters.
+			masked: live !== undefined ? id === CUSTOM_PROVIDER.envVar ? "••••" : `${maskKey(live)} (${live.trim().length} chars)` : null,
 			source: isRealEnv ? "env" : live !== undefined ? "file" : "none",
 			shadowedByEnv: isRealEnv && fileValue !== undefined && envValue !== fileValue,
 		});