Decide storage semantics for trusted client IP shared secret #1145

Source finding from PR #1049 documentation refresh: trusted_client_ip.shared_secret is redacted in diagnostics but remains inline in the configuration blob and is not returned by secret_fields.

Acceptance: document a security decision. Either confirm and test inline storage as intentional, or migrate the value to a secret-store reference with compatibility and validation coverage.