v4.6.0 — a secret is its own type

Mirrors baseline v4.6.0, the Go 1.27 defect backlog, pinning baseline commit b6a731e.

A secret is its own type. InviteCode, AnthropicKey and SMTPPassword are a Secret carrying LogValue, String and MarshalText. Config.LogValue stays — it is the allowlist — but it only fires when the Config is the value logged.

That distinction is the thing this sync proved rather than argued. TestConfig_SecretsNeverLogged is seven cases against a config holding three real secrets, and six of them fail when the fields are plain strings: a struct that contains the config, a slice of configs, a map of configs, %+v over the config, and the field on its own by either route all print the key. Only "the config itself" passes — which is exactly the one case the previous test covered, and it did not even set a secret. The three string(...) conversions the type forces at anthropic.New, smtpmail.New and the InviteCode field are the cost of the rule, visible in the diff rather than described.

Both pools are asserted idle at the end of every store test, registered after the Close cleanup so LIFO runs it first. The store was already closing every Rows, Stmt and Tx — so the baseline's new rule 8 writes down a practice that was right and unwritten, which is the shape the self-improvement rule predicts.

make fmt loops go fix to a clean -diff and runs goimports again after it. It proved itself in the same run that needed it: the new test's fmt import was added automatically.

Also: apiJSON's buffering comment now gives the v2 reason — Marshal returns the bytes it got through and an error — rather than the v1 one it was written with. parseBaseURL lost the strings.TrimSuffix whose comment claimed JoinPath would double the slash; it does not.

./verify.sh exits 0 over 79 gates, and make ci is green on this commit. Nothing needed a waiver.