dashboard_redacted deletes the entire [database] section, breaks the dashboard UI, and still returns API keys/password in plaintext

Gorse version Reproduced on Gorse v0.5.7; confirmed unchanged on current master. Deployment: docker compose (bundled dashboard).

Describe the bug master/rest.go → getConfig: https://github.com/gorse-io/gorse/blob/261a0184102b838ee973eb8b73d21d2fb317b576/master/rest.go#L600-L602

Redaction (added in #635) removes the entire database map key rather than masking secret values. The bundled dashboard frontend assumes database exists and throws while rendering:

Uncaught (in promise) TypeError: Cannot read properties of undefined (reading 'cache_size')

That unhandled error aborts the panel that lists non-personalized recommenders. Meanwhile api_key / admin_api_key / dashboard_password live under master/server, so they’re returned regardless of the flag.

To Reproduce

• Define at least one custom [[recommend.non-personalized]] recommender other than latest.
• Set [master] dashboard_redacted = true and start Gorse.
• Open the Dashboard → the non-personalized recommender selector shows only latest; custom recommenders are missing. Browser Console shows the cache_size TypeError.
• GET /api/dashboard/config (with redaction on) → database credentials are hidden, but api_key/admin_api_key/dashboard_password are present in plaintext.
• Set dashboard_redacted = false → recommenders reappear in the UI.

Expected behavior

• Redaction should not break unrelated UI.
• Redaction should actually hide all secrets (keys, passwords, tokens, and the data_store URI’s password), not just the database section.

Additional context Set dashboard_redacted = false and protect the dashboard at the network layer (don’t expose the port publicly; firewall/VPN/authenticated proxy).

Note: the flag does not protect api_key/admin_api_key/dashboard_password even when enabled.

Confirmed empirically: with dashboard_redacted = true, admin_api_key, dashboard_password, and server.api_key remain visible in both the dashboard Settings page and GET /api/dashboard/config. Only the [database] section is removed, which simultaneously breaks the non-personalized recommender UI (frontend cache_size TypeError) and fails to hide the actual credentials.