fix(security): stop leaking live Jira/Tempo admin tokens in config export

_REDACTED_KEYS listed jira.api_token/jira.password/tempo.api_token, but
routers/system.py actually writes admin credentials under
jira.admin_api_token and tempo.admin_token. The mismatch meant every
config export bundle included the live Jira and Tempo admin API tokens
in plaintext instead of redacting them. Found while researching the
Jira/Tempo integration for a service-account request; added a
regression test.

backend/app/routers/admin_config.py

@@ -32,9 +32,17 @@ from app.models.webhook_config import WebhookConfig
 
 router = APIRouter(prefix="/admin", tags=["admin"])
 
-# Keys whose values contain secrets and must be redacted in the export
+# Keys whose values contain secrets and must be redacted in the export.
+# Must be kept in sync with the actual SystemConfig keys written by
+# routers/system.py's _JIRA_KEYS map and the SMTP settings section —
+# a stale/mismatched name here silently exports a live credential in
+# plaintext instead of redacting it.
 _REDACTED_KEYS = {
     "smtp.password",
+    "jira.admin_api_token",
+    "tempo.admin_token",
+    # Older/alternate key names kept defensively in case a prior schema
+    # version wrote under these instead.
     "jira.api_token",
     "jira.password",
     "tempo.api_token",