[SandObserver]

Summary

• Send savedRow (the row's index in the saved config, or null for a new row) on every row of a group that holds a secret field. The name lives in the new import-free ui/js/saved-row.js, shared by the editor and the API.
• Add alignSavedConfig(): when every field outside the secret-holding groups matches the saved config, pair each posted row with the saved row it names, and refill that row's secrets only when its own non-secret, non-cosmetic, non-transient fields match. Rows without savedRow fall back to id, then position.
• Use it for config saves (preserveAllSecrets) and for POST /api/widget-options/:id. A row whose destination changed is still withheld and reported.
• Strip savedRow in stripWidgetSecrets and preserveWidgetSecrets, so it is never stored and an unchanged save still matches.
• Keep each row's <key>Set marker in the editor through adding and removing rows, so untouched rows show "Configured".
• Copy saved-row.js into the API image and map it in tsconfig.frontend.json.

Testing
All green, e2e included. Added unit tests for row alignment and config saves, and an e2e test that removes a Connections service and keeps the other's token.

Changelog

Fixed

• Adding or removing a row in a widget's settings keeps the stored passwords and keys of the other rows.

Checklist

• Stays within the project constraints: one container, no runtime dependencies, no build step (see CONTRIBUTING.md).
• Tests added or updated for new logic, and the full suite, lint, and typechecks pass.
• Docs updated if behavior or configuration changed.