test(management): freeze scrubber fragment coverage over DataConnection config types + document array-merge limit (plan R2-07 T12)

src/ZB.MOM.WW.ScadaBridge.ManagementService/ConfigSecretScrubber.cs

@@ -18,7 +18,7 @@ internal static class ConfigSecretScrubber
     private static readonly string[] SecretNameFragments =
         ["password", "secret", "token", "apikey", "credential", "passphrase"];
 
-    private static bool IsSecretName(string propertyName)
+    internal static bool IsSecretName(string propertyName)
     {
         foreach (var fragment in SecretNameFragments)
         {
@@ -127,6 +127,15 @@ internal static class ConfigSecretScrubber
     /// <param name="incoming">The client-submitted config JSON, possibly containing sentinel values.</param>
     /// <param name="stored">The previously stored config JSON to source real secret values from.</param>
     /// <returns>The incoming JSON with sentinel values replaced by the corresponding stored values.</returns>
+    /// <remarks>
+    /// <b>Array limitation (arch-review R2 N9):</b> sentinel restoration inside arrays
+    /// pairs incoming[i] with stored[i] BY INDEX. A client that reorders an array of
+    /// credentialed objects while round-tripping sentinels grafts the wrong stored
+    /// secret into each slot — a silent misconfiguration (never a disclosure). Clients
+    /// must not reorder arrays that carry sentinels (the CLI round-trip does not);
+    /// key-based matching is a possible future refinement if a config type ever nests
+    /// credentialed arrays.
+    /// </remarks>
     public static string? MergeSentinels(string? incoming, string? stored)
     {
         if (string.IsNullOrEmpty(incoming))