fix(config): mask smtp password in global put response

Prevent commentSmtpPass from being echoed in PUT responses while preserving existing response behavior for all other config keys.

Made-with: Cursor

server/api/config/global.put.ts

@@ -12,6 +12,13 @@ type UpdateGlobalConfigBody = {
     value: unknown;
 };
 
+function toSafeResponseValue(key: string, value: unknown) {
+    if (key === "commentSmtpPass") {
+        return "";
+    }
+    return value;
+}
+
 export default defineWrappedResponseHandler(async (event) => {
     try {
         await requireAdmin(event);
@@ -23,7 +30,7 @@ export default defineWrappedResponseHandler(async (event) => {
         const value = await event.context.config.getGlobal(key);
         return R.success({
             key,
-            value,
+            value: toSafeResponseValue(key, value),
         });
     } catch (err) {
         throw toPublicConfigError(err);