v0.3.3 — P1 security: remove key-format prefix from API-key placeholder

class-prv-key-manager-renderer.php rendered placeholder="sk-or-..." on
the write-only password input, leaking the provider key format in page HTML.

This caused the smoke-suite write-only invariant assertion to fail (CI run
2026-06-17 job 81824705096: expect(html).not.toContain("sk-or-")). The
placeholder now reads "Paste provider API key" — neutral, no key-format
prefix, no provider information exposed in rendered HTML.

The value="" write-only invariant was already correct. The encrypted-at-rest
storage was already correct. This fixes the sole remaining output surface.

Full-codebase audit confirms no other path emits the decrypted key:
- No wp_localize_script calls anywhere in the plugin
- No REST endpoints registered
- No data attributes containing key fields
- All get_key() callers use the plaintext server-side only (HTTP auth header)
- error_log() in probe executor logs HTTP status only, never the key value

Agent-Session: prv-key-leak-fix-20260619

includes/core/class-prv-key-manager-renderer.php

@@ -12,7 +12,10 @@ declare(strict_types=1);
  *
  * Outputs only the key SOURCE (constant / admin / not set) and the
  * last-run API status. The stored key value is NEVER included in any
- * output: not in HTML, not in JS, not in data attributes.
+ * output: not in HTML, not in JS, not in data attributes. The password
+ * input placeholder must also never contain a key format prefix (e.g.
+ * 'sk-or-') — even a format hint in the placeholder leaks provider
+ * information and trips write-only security guards.
  *
  * Three states:
  *  - SOURCE_CONSTANT: constant defined → lock the input, show note.
@@ -120,10 +123,13 @@ class PRV_Key_Manager_Renderer {
 		echo '</label>';
 
 		// Input always renders empty — never outputs stored key.
+		// Placeholder must not include a key-format prefix (e.g. 'sk-or-');
+		// even a format hint leaks provider information and will trip
+		// write-only security assertions in the smoke suite.
 		echo '<input type="password" id="prv_api_key" name="prv_api_key" '
 			. 'class="prv-input" style="max-width:420px" '
 			. 'value="" autocomplete="new-password" '
-			. 'placeholder="' . esc_attr( $is_const ? __( 'Managed via wp-config — cannot override', 'pr-vision' ) : __( 'sk-or-…', 'pr-vision' ) ) . '"'
+			. 'placeholder="' . esc_attr( $is_const ? __( 'Managed via wp-config — cannot override', 'pr-vision' ) : __( 'Paste provider API key', 'pr-vision' ) ) . '"'
 			. ( $is_const ? ' disabled aria-disabled="true"' : '' ) . '>';
 
 		if ( $is_const ) {