VS Code's sign-in keeps its place; recordings checked for secrets

From review.
- /profile asked before signing in keeps its query for ten minutes, and
  the sign-in (password or OIDC) returns to it: VS Code's sign-in state
  came back lost, and the confirmation came every time. Only /profile is
  ever returned to.
- The extension keeps an https gateway at https when a link names it by
  plain http (a proxy ending TLS unannounced), so the key is never sent in
  the clear. The install command says --force, since dev builds share a
  version and VS Code kept the old one.
- Every frame of every install recording is checked for a key, a
  password or a private key, not only the page.
- The admin API document again matches the API: f94d902's
  MCPServerRequest.clear was not in it.
- CHANGELOG for this round's fixes.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/admin-api.openapi.json

@@ -7550,6 +7550,13 @@
           "rate_per_minute": {
             "type": "integer",
             "description": "RatePerMinute bounds each caller's calls to its tools; a negative number takes the bound away."
+          },
+          "clear": {
+            "type": "array",
+            "items": {
+              "type": "string"
+            },
+            "description": "Clear empties what an empty field above would leave as it is: \"description\", \"timeout\" (back to the default), \"rate\"."
           }
         }
       },