PR Vision settings API-key input had placeholder="sk-or-…" which rendered the provider key-format prefix in admin HTML (tripping the not.toContain("sk-or-") smoke assertion). The real key value was never rendered (value="" write-only was correct). Placeholder is now neutral. Full-codebase audit: no other key-output path. v0.3.3.
QA: APPROVE (2026-06-19-e4c51ee).
Agent-Session: prv-key-leak-fix-20260619
Squash-merge PR #6: PR Vision v0.2.3 — UI-editable encrypted provider API key
QA APPROVED: 2026-06-14-85956da7c86bed2c9e2cf60625fda0cf2e9518bb.md
All 5 CI checks green on head SHA 85956da7c8
