Add editing existing integrations, so an expired secret can be rotated

Manage integrations only supported add/toggle/delete — fixing an
expired API token meant deleting and recreating the whole integration.

- New GET /api/integrations/:id/config returns only the non-secret
  config fields (never the decrypted secret) so an edit form can
  pre-fill URL/tailnet/etc. fields.
- New POST /api/integrations/:id/test merges the stored, decrypted
  config with any freshly-typed overrides and pings the real adapter —
  lets "Test connection" work during an edit without ever sending the
  current secret back to the browser.
- New IntegrationEditForm component: secret fields render blank with a
  "leave blank to keep the current value" placeholder; submitting only
  sends the fields that were actually filled in, so a name/URL edit
  can't accidentally wipe a secret and a secret rotation can't touch
  anything else. Reuses the existing PATCH /:id route, which already
  merged partial config updates correctly.

Verified end-to-end against the real dev server: confirmed via direct
DB decryption that a non-secret-only edit leaves the stored secret
byte-for-byte unchanged, and that a secret-only edit rotates it without
touching other config; the test route was confirmed to make a real
network call (got a genuine "API token invalid" from Tailscale's API
against a fake key).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

README.md

@@ -51,7 +51,9 @@ All modules from the original plan are built:
   configurable time/timezone), and DNS provider badge-color customization.
 
 All six integrations follow the same config-in-UI + encrypted-credentials
-pattern, added through **Integrations → Manage integrations**.
+pattern, added (and edited — e.g. to rotate an expired API token without
+recreating the whole integration) through **Integrations → Manage
+integrations**.
 
 **Verified for real, end to end**: every module above — including all six
 integrations, both their read-only views and their write actions