Security: one credential name classifier for settings and workflow parameters

Two lists decide whether a name looks like a credential, and they disagree. `barakoCMS/Features/Settings/UpdateSetting.cs:45-46` refuses a plain setting whose key contains `apikey`, `api_key`, `password`, `secret`, `token`, `credential` or `privatekey`. `barakoCMS/Features/Workflows/Actions/WebhookSigning.cs:184-188` also treats `passwd`, `pwd`, `private_key`, `accesskey` and `access_key` as credentials.

### Why it is too specific

Each list was written for one surface. A setting called `Smtp:Passwd` or `Storage:AccessKey` is saved in plaintext and returned by `GET /api/settings`, while the same word in a workflow parameter is hidden. The next surface that needs the check (connectors, module settings, import) would write a third list.

### The general concept

One credential name classifier in `Infrastructure/Security`, used by settings, workflow parameters and anything later.

### Where it lives

Core: `Infrastructure/Security`, used by `Features/Settings` and `Features/Workflows`.

### Compatibility

Released. Settings would refuse keys they accept today (`passwd`, `pwd`, `accesskey`, `private_key`), which tightens request validation and breaks the HTTP contract. It rides the contract bump to 4 already in flight in #867 and #861. Settings already stored under those keys stay readable, and the changelog says to move them to the encrypted endpoint.

### Done when

- Saving a setting named `Storage:AccessKey` through the settings endpoint is refused, and a test showing that fails before the change.
- Settings and workflow parameters call the same classifier, with one test covering its word list.
- Existing stored settings with those names are still returned.

Found in the too specific sweep of 15 September 2026.

Start by reading the credential checks in barakoCMS/Features/Settings/UpdateSetting.cs:45-46 and barakoCMS/Features/Workflows/Actions/WebhookSigning.cs:184-188, then inspect Infrastructure/Security and the settings and workflow entry points. Add the tests described under “Done when”: shared word-list coverage, settings rejection for Storage:AccessKey, and continued retrieval of existing stored settings.

Written by the indexing model from the issue text.