### Check for existing issues

- [X] I have searched the existing issues and checked that my issue is not a duplicate.

### What happened?

`/credentials` and `/credentials/by_name/{name}` return `credential_values` masked (for example `sk-p****cdef`). The dashboard's `EditCredentialModal` pre-populates its form from those masked values, the submit path keeps every non-empty field, and `credentials.tsx` forwards them as `credential_values` to `PATCH /credentials/{name}`. The backend encrypts and merges every supplied field into the stored credential and the in-memory cache, so a metadata-only credential edit can replace the real provider API key with the masked placeholder string.

**Observed:** The form initial values include `api_key: "sk-p****cdef"` (the masked value from the API). The submit filter keeps every non-empty field, so the PATCH body includes `credential_values: {api_key: "sk-p****cdef"}`. The backend encrypts the placeholder as if it were a real secret, merges it into `credential.credential_values`, and updates `in_memory_values` as well. The next provider call using this credential fails because the upstream API rejects the masked string.

**Expected:** A metadata-…