R-970: the box's hub key opens no route; Data tab leftovers; R-1103: the install form's dead branches

R-970: /api/config, /api/config/hash, /api/config/apply removed (they read and replaced controller.yaml with
every secret, reachable with the box's own hub API key, unsigned; nothing called them). The hub-key Bearer
door on /api/selfupdate/ and /api/geo/ and the matching CSRF exemption are gone; the dashboard keeps using
those with a session. The route table is buildMux, so a test drives the real one.

Data tab: the export password field is autocomplete=new-password with a non-login name; the 2nd copy's
status rows that repeated the form are gone (the no-target reason moves into the form).

R-1103: app_fields.html loses its installed-only branches (no page serves them since R-1095); the tests
that rendered that dead path are retired, their rules asserted on the settings tab (R-694 moved there).

Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS

controller/internal/web/deploy_secret_exposure_test.go

@@ -45,28 +45,10 @@ func renderDeployPage(t *testing.T, alreadyDeployed bool) string {
 	return buf.String()
 }
 
-// RED-PROOF: drop the `{{if $isDeployed}}` branch so the deployed page renders `value="{{$val}}"`
-// again — this fails, showing the secret returning to the body of a page with nothing to submit.
-func TestDeployPage_DeployedApp_DoesNotCarryTheSecret(t *testing.T) {
-	html := renderDeployPage(t, true)
-
-	if strings.Contains(html, testDeploySecret) {
-		t.Error("R-254 site two: an already-deployed app's generated secret is in the response body " +
-			"of its settings page — nothing there submits it, so there is no form reason for it to " +
-			"be in the page at all")
-	}
-	// Assert the CONTROL, not the URL: the revealAutoField() function ships in the page script on
-	// both variants, so a substring match on the endpoint path matches the script and would report a
-	// control that is not there. (This test caught exactly that on itself.)
-	if !strings.Contains(html, `onclick="revealAutoField('vaultwarden','DB_PASSWORD'`) {
-		t.Error("no reveal control rendered, so the customer cannot see their own generated secret")
-	}
-	// The hidden input must NOT appear on a deployed app — it never did, and that is the asymmetry
-	// that makes the readonly input indefensible there.
-	if strings.Contains(html, `<input type="hidden" name="DB_PASSWORD"`) {
-		t.Error("a submit-carrying hidden input rendered on an already-deployed app")
-	}
-}
+// v0.322.0 (R-1103): TestDeployPage_DeployedApp_DoesNotCarryTheSecret is retired — the install form no longer renders
+// for an installed app (R-1095, 302 to the settings tab). Its rule (an installed app's generated secret is not in the
+// page; an eye fetches it) is asserted where the value is shown now: TestAppPage_LoginPairPanel (SECRET_KEY,
+// ADMIN_USER, ADMIN_PASSWORD never in the settings page; every eye answers) and TestR255_NoPlantedSecretReachesAnyPage.
 
 // The OTHER half of §7.2's answer: the pre-deploy form still carries the value, deliberately. If this
 // ever starts failing, someone has "fixed" a form by stopping it submitting what it must submit —