Home Assistant's UptimeRobot heartbeat credential resolves from secrets.yaml

## Summary

Rotate the UptimeRobot heartbeat credential used by Home Assistant's `rest_command.uptime_robot_heartbeat` and move it behind `!secret`, so it is not readable from `configuration.yaml`.

## Motivation

The heartbeat URL is a bearer credential in URL form: anyone holding it can post heartbeats. Forged heartbeats keep the monitor green while Home Assistant is actually down — the exact condition the monitor exists to detect — and the monitor's own status cannot reveal the forgery, because a heartbeat monitor observes only that pings arrive, never their origin.

The affected monitor is UptimeRobot `801199433` ("Home Assistant", type `HEARTBEAT`, tags `home`/`hass`), currently UP for 388 days. The value embedded in `configuration.yaml` is that monitor's identifier combined with its heartbeat token.

Found 2026-09-12 while surveying the Home Assistant configuration for agent-assisted automation work. The value was also pasted into a terminal during that session, so treat the current credential as disclosed regardless of the outcome here.

`configuration.yaml` already resolves `!secret todoist_api_token` for the Todoist calendar platform, so the mechanism and the file are both in place.

## Scope

- Regenerate monitor `801199433`'s heartbeat credential, or create a replacement monitor carrying the same tags.
- Add the new value to `secrets.yaml` on the Home Assistant host.
- Change `rest_command.uptime_robot_heartbeat` to reference it through `!secret`.
- Reload Home Assistant and confirm the monitor receives heartbeats from the new value.
- Retire the previous credential.

## Acceptance criteria

- [ ] `configuration.yaml` holds no literal heartbeat credential.
- [ ] The monitor reports UP on heartbeats sent through the `!secret` reference.
- [ ] The previous credential no longer registers heartbeats.

## Additional context

Home Assistant OS 18.2, Core 2026.9.1.

`secrets.yaml` values are readable by Home Assistant administrators through the UI's YAML and trace viewers, so this narrows exposure rather than eliminating it. That is an acceptable trade for a heartbeat credential whose worst case is a masked outage.

The `NanoPi-NEO3` monitor (`801212178`) is the same heartbeat type; whether its credential has the same exposure is not established here and is worth a separate look.