fix(api): mask build arguments and preserve secrets on round trips - #864

Summary

Mask build-argument values in service, scan, drift, build-status and deployment responses, including retained deployment history. Restore masked values on writes so editing a service or redeploying cannot replace a secret with the mask sentinel.

Motivation

Deployment snapshots and service rows masked environment but returned buildArgs verbatim. Older releases consequently exposed earlier secret values after rotation. Output masking also needs write-path recovery to preserve working builds and rollback snapshots.

Related issue

Fixes #854

Changes

• Mask non-empty build args at the shared response boundary, preserve empty/null semantics, and remove raw imported/drift snapshots from direct service responses.
• Recover sentinels for create/update, Compose sync and deployment requests using stored rows or the staged upload. Preserve interpolation provenance for unchanged masked args.
• Keep retained snapshots intact internally for rollback and mask them when read; no migration is required.
• Return project/service/key-scoped HMAC fingerprints for stored literal args, allowing comparison between a rotation's write response and deployment history without exposing values or unkeyed hashes.

Fingerprints cover stored literals. Inherited and interpolated args are excluded because their effective values depend on the build environment; fingerprints do not attest running-container state. These semantics and whole-map build-arg replacement are documented in the Services API guide.

Verification

• Before the fix: four response/write regressions fail, including serialized deployment secrets and persisted mask sentinels.
• bun run test -- --filter=!openship -- --maxWorkers=2: all six workspace tasks passed; API: 478 files, 5642 passed / 3 skipped.
• CLI suite validated separately with a 15-second timeout for its existing local port-release wait.
• bun run --cwd apps/api lint: passed.
• Regression coverage includes historical rotation fingerprints, scope isolation, scan/drift masking, empty/null args, creation, masked edits, Compose sync, upload/stored recovery and untouched rollback input.
• Ran bun run format in an isolated checkout and retained only formatting within this change.

Checklist

• One issue per PR, with a scoped diff
• Regression tests fail before the fix and pass afterward
• Relevant tests, typecheck and formatting completed locally
• Reviewed the implementation and test behavior