[SandObserver]

Summary

• Run migrate on the incoming config before preserveAllSecrets in POST /api/config, so a legacy widget type is renamed before secrets are matched.
• Refill a widget secret only when the stored item is a widget of the same widgetType, in preserveAllSecrets and in POST /api/widget-options.
• Count a removed or emptied settings.server.portMap as a rewrite change in rewriteChanged.
• Withhold stored widget secrets when settings.server.skipTlsVerify is turned on or off.
• List a widget with no manifest in withheld when a rewrite or certificate change clears its stored config.

Testing
All green. Added 9 tests covering legacy-type saves, type changes on save and options fetch, port map removal, the global certificate skip and withheld unknown widgets.

Changelog

Security

• Keep a stored widget secret out of the browser when a save sends the widget under a legacy type.
• Withhold stored secrets when a widget's type changes, the port map is removed, or certificate checking for widgets is turned on or off.

Fixed

• Name a widget without a manifest for re-entry when a port map change clears its settings.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.