fix(api): redact third-party credentials in ddns/notification list

GET /api/v1/ddns and /api/v1/notification returned full objects with
plaintext credentials (Cloudflare/TencentCloud secrets, webhook URLs
with embedded bot tokens, Authorization headers). Redact these fields
in the list responses.

Since the frontend edit form repopulates from the list endpoint, the
update handlers now treat an empty submitted credential as "no change"
and preserve the stored value, preventing accidental secret wipes.

Ref: GHSA-ww5p-j6cj-6mqq

service/singleton/testhelpers.go

@@ -43,6 +43,7 @@ func (c *DDNSClass) InsertForTest(p *model.DDNSProfile) {
 	c.listMu.Lock()
 	c.list[p.ID] = p
 	c.listMu.Unlock()
+	c.sortList()
 }
 
 // NewEmptyNotificationClassForTest 构造空 NotificationClass。
@@ -62,4 +63,5 @@ func (c *NotificationClass) InsertForTest(n *model.Notification) {
 	c.listMu.Lock()
 	c.list[n.ID] = n
 	c.listMu.Unlock()
+	c.sortList()
 }