Home Assistant's UptimeRobot heartbeat credential resolves from secrets.yaml

## Summary

Rotate the UptimeRobot heartbeat credential used by Home Assistant's `rest_command.uptime_robot_heartbeat` and move it behind `!secret`, so it is not readable from `configuration.yaml`.

## Motivation

The heartbeat URL is a bearer credential in URL form: anyone holding it can post heartbeats. Forged heartbeats keep the monitor green while Home Assistant is actually down — the exact condition the monitor exists to detect — and the monitor's own status cannot reveal the forgery, because a heartbeat monitor observes only that pings arrive, never their origin.

The affected monitor is UptimeRobot `801199433` ("Home Assistant", type `HEARTBEAT`, tags `home`/`hass`), currently UP for 388 days. The value embedded in `configuration.yaml` is that monitor's identifier combined with its heartbeat token.

Found 2026-09-12 while surveying the Home Assistant configuration for agent-assisted automation work. The value was also pasted into a terminal during that session, so treat the current credential as disclosed regardless of the outcome here.

`configuration.yaml` already resolves `!secret todoist_api_token` for the Todoist calendar platform, so the mechanism and the file are both in place.

## Scope

- Regenerate monitor `801199433`'s heartbeat credential, or create a replacement monitor carrying the same tags.
- Add the new value to `secrets.yaml` on the Home Assistant host.
- Change `rest_command.uptime_robot_heartbeat` to reference it through `!secret`.
- Reload Home Assistant and confirm the monitor receives heartbeats from the new value.
- Retire the previous credential.

## Acceptance criteria

- [ ] `configuration.yaml` holds no literal heartbeat credential.
- [ ] The monitor reports UP on heartbeats sent through the `!secret` reference.
- [ ] The previous credential no longer registers heartbeats.

## Additional context

Home Assistant OS 18.2, Core 2026.9.1.

`secrets.yaml` values are readable by Home Assistant administrators through the UI's YAML and trace viewers, so this narrows exposure rather than eliminating it. That is an acceptable trade for a heartbeat credential whose worst case is a masked outage.

The `NanoPi-NEO3` monitor (`801212178`) is the same heartbeat type; whether its credential has the same exposure is not established here and is worth a separate look.

Read configuration.yaml for rest_command.uptime_robot_heartbeat and the existing !secret usage for todoist_api_token, then update secrets.yaml on the Home Assistant host with a regenerated UptimeRobot heartbeat value for monitor 801199433. Done means configuration.yaml has no literal credential, Home Assistant sends heartbeats via the secret, and the old credential no longer works.

Vom Indexierungsmodell aus dem Issue-Text verfasst.