A test pins removing a secret from Settings: a forge admin only, same-origin only, and the value never echoed #7019

POST /settings/secrets/delete (secretDelete in src/web/pages/secrets.ts) has no test.

Done:

• [ ] Each case posts the form the way the page does, through readForm, with the session cookie and a same-origin Origin header. An admin removes a named secret. The redirect's flash names it, and resolveSecrets no longer has it.
• [ ] A non-admin, someone signed out, and a cross-origin post are each refused, and the secret stays.
• [ ] No answer, and no event written, carries the secret's value.

Files: test/settings-secret-delete.test.ts

If the test finds the behaviour wrong, fix the handler it names in the same pull and say so. If the check fails in a test this pull does not touch, name it in the pull rather than widening the change.

Before pushing: bun x tsc --noEmit and the new test.