dashboard_redacted deletes the entire [database] section, breaks the dashboard UI, and still returns API keys/password in plaintext

**Gorse version**
Reproduced on Gorse v0.5.7; confirmed unchanged on current master.
Deployment: docker compose (bundled dashboard).

**Describe the bug**
`master/rest.go → getConfig`:
https://github.com/gorse-io/gorse/blob/261a0184102b838ee973eb8b73d21d2fb317b576/master/rest.go#L600-L602

Redaction (added in #635) removes the entire database map key rather than masking secret values. The bundled dashboard frontend assumes database exists and throws while rendering:
```
Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'cache_size')
```
That unhandled error aborts the panel that lists non-personalized recommenders. Meanwhile `api_key / admin_api_key / dashboard_password` live under master/server, so they’re returned regardless of the flag.

**To Reproduce**
* Define at least one custom [[recommend.non-personalized]] recommender other than `latest`.
* Set [master] dashboard_redacted = true and start Gorse.
* Open the Dashboard → the non-personalized recommender selector shows only latest; custom recommenders are missing. Browser Console shows the **cache_size TypeError**.
* GET /api/dashboard/config (with redaction on) → database credentials are hidden, but api_key/admin_api_key/dashboard_password are present in plaintext.
* Set dashboard_redacted = false → recommenders reappear in the UI.

**Expected behavior**
* Redaction should not break unrelated UI.
* Redaction should actually hide all secrets (keys, passwords, tokens, and the data_store URI’s password), not just the database section.

**Additional context**
Set `dashboard_redacted = false` and protect the dashboard at the network layer (don’t expose the port publicly; firewall/VPN/authenticated proxy).

Note: the flag does not protect api_key/admin_api_key/dashboard_password even when enabled.

Confirmed empirically: with `dashboard_redacted = true`, **admin_api_key, dashboard_password, and server.api_key remain visible** in both the dashboard Settings page and GET /api/dashboard/config. Only the [database] section is removed, which simultaneously breaks the non-personalized recommender UI (frontend cache_size TypeError) and fails to hide the actual credentials.

Start in master/rest.go at getConfig and reproduce GET /api/dashboard/config with dashboard_redacted enabled. Trace how the bundled dashboard consumes the database section and populates non-personalized recommenders. Done means the UI still renders and all listed keys, passwords, tokens, and the data_store URI password are hidden while non-secret configuration remains available.

Written by the indexing model from the issue text.