Admin settings: the 'prefer the environment variable' hint shows only for provider secrets, not for the VAPID public key (read environment-first too, but not a secret); the settings row says secret: true|false

ddiff --git a/public/admin.html b/public/admin.html
iindex 0274ab8d..b3f4f74a 100644
---- a/public/admin.html
++++ b/public/admin.html
@@@ -1390,7 +1390,7 @@ async function loadToolsSettings() {
                              <label for="ts-${esc(key)}"><strong>${esc(key)}</strong></label>
                              <input type="${isSensitive?'password':'text'}" id="ts-${esc(key)}" data-key="${esc(key)}" data-type="${esc(s.type||'string')}" value="${esc(s.value)}"
                                  style="margin-top:4px;padding:8px 10px;background:var(--bg-input);border:1px solid var(--border);border-radius:6px;color:var(--text);font-size:13px">
--                            ${s.source === 'database' && s.env ? `<span class="muted" style="font-size:12px;margin-top:4px">Stored in the database; prefer <code>${esc(s.env)}</code> in the server's environment file.</span>` : ''}
++                            ${s.source === 'database' && s.env && s.secret ? `<span class="muted" style="font-size:12px;margin-top:4px">Stored in the database; prefer <code>${esc(s.env)}</code> in the server's environment file.</span>` : ''}
                          </div>`;
                  }).join('')}
                  <div style="margin-top:16px"><button type="button" class="btn btn-primary" onclick="saveToolsSettings()"><i class="fa-solid fa-floppy-disk"></i> Save Settings</button></div>
ddiff --git a/server/admin/routes.js b/server/admin/routes.js
iindex 385764a0..ea617461 100644
---- a/server/admin/routes.js
++++ b/server/admin/routes.js
@@@ -329,7 +329,7 @@ function createAdminRoutes(db, notificationService, emailService, requireAuth) {
                      const src = secrets.source(db, r.key);
                      if (src === 'env') { settings[r.key] = { value: '', type: r.type, source: 'env', env: secrets.envName(r.key), redacted: true }; continue; }
                      if (!owner) { settings[r.key] = { value: maskSecret(r.value), type: r.type, source: src, env: secrets.envName(r.key), redacted: true }; continue; }
--                    settings[r.key] = { value: r.value, type: r.type, source: src, env: secrets.envName(r.key) };
++                    settings[r.key] = { value: r.value, type: r.type, source: src, env: secrets.envName(r.key), secret: secrets.isSecret(r.key) };
                      continue;
                  }
                  // Secrets (API keys / tokens / credentials) are owner-only — mask for admins.