feat(web): token 数以 K 输入显示,已存凭证显示掩码占位(FIX-8)

- 新增 UnitInput 与 kind=tokens:上下文预算、单次 token 上限、自定义模型上下文窗口以 K 输入(允许小数),存储仍为原始 token 数;校验与提示用 K 表述;列表/详情 token 数统一 K/M 简写(formatTokens)
- 新增 SecretInput 与 kind=secret:已保存时显示「已设置 ••••••••」(有服务端掩码时带末 4 位),聚焦直接输入替换,留空保持,「清除」确认后保存生效;替换模型服务、TMDB、网页搜索、下载器、媒体服务器、浏览器服务、站点账号、Passkey、本机 Token 各处
- 统一只写凭证服务端语义:省略或空串 = 不变,null = 清除(contracts secretInput);下载器/媒体服务器新增清除;站点凭证同类更新可留空保持密码/Cookie/API Key/TOTP,TOTP 可 null 清除,不再误删 TOTP 与 UA
- contextBudget 最小值 4096→4000、contextWindow 1024→1000,便于按 K 填写
- 测试:换算与校验、SecretInput 渲染与状态、各接口留空不变/显式清除

Co-Authored-By: Claude Opus 5.5 <[email protected]>

packages/contracts/src/instances.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { EntityBase, Id, JsonObject, SERVER_MANAGED, Timestamp } from "./common.ts";
+import { EntityBase, Id, JsonObject, SERVER_MANAGED, Timestamp, WriteOnlySecret } from "./common.ts";
 import { SiteCredentialsBody } from "./sources.ts";
 
 // 实例域:媒体库根、下载器实例、媒体服务器实例、路径映射(REQ §7.1、§8.4、§12.5)
@@ -44,8 +44,8 @@ export type LibraryRootCreate = z.infer<typeof LibraryRootCreate>;
 export const LibraryRootUpdate = LibraryRootCreate.partial();
 export type LibraryRootUpdate = z.infer<typeof LibraryRootUpdate>;
 
-/** 只写凭证:明文仅在请求中出现,绝不回显 */
-const Credential = z.string().min(1).max(4096);
+/** 只写凭证:明文仅在请求中出现,绝不回显;空串 = 不设置 / 不修改 */
+const Credential = WriteOnlySecret(4096);
 
 export const DownloaderKind = z.enum(["qbittorrent"]);
 export type DownloaderKind = z.infer<typeof DownloaderKind>;
@@ -91,7 +91,10 @@ export const DownloaderInstanceCreate = DownloaderInstance.pick({
     authKind: DownloaderAuthKind.optional(),
   });
 export type DownloaderInstanceCreate = z.infer<typeof DownloaderInstanceCreate>;
-export const DownloaderInstanceUpdate = DownloaderInstanceCreate.partial();
+/** 更新:credential 省略或空串 = 不变,null = 清除 */
+export const DownloaderInstanceUpdate = DownloaderInstanceCreate.partial().extend({
+  credential: Credential.nullable().optional(),
+});
 export type DownloaderInstanceUpdate = z.infer<typeof DownloaderInstanceUpdate>;
 
 export const MediaServerKind = z.enum(["emby", "jellyfin"]);
@@ -121,7 +124,10 @@ export const MediaServerInstanceCreate = MediaServerInstance.pick({
   .partial({ kind: true, userId: true, enabled: true, settings: true })
   .extend({ credential: Credential.optional() });
 export type MediaServerInstanceCreate = z.infer<typeof MediaServerInstanceCreate>;
-export const MediaServerInstanceUpdate = MediaServerInstanceCreate.partial();
+/** 更新:credential 省略或空串 = 不变,null = 清除 */
+export const MediaServerInstanceUpdate = MediaServerInstanceCreate.partial().extend({
+  credential: Credential.nullable().optional(),
+});
 export type MediaServerInstanceUpdate = z.infer<typeof MediaServerInstanceUpdate>;
 
 export const PathViewKind = z.enum(["downloader", "media_server"]);
@@ -191,7 +197,7 @@ export const SiteCredentialsLegacyPut = z.object({
   label: z.string().min(1).max(80).default("default"),
   authKind: z.enum(["cookie", "passkey", "api_key", "password"]),
   /** 只写明文 */
-  credential: Credential,
+  credential: z.string().min(1).max(4096),
   /** authKind=password 时的登录名 */
   username: z.string().max(200).optional(),
   enabled: z.boolean().optional(),