fix(httpapi): redact agent_secret from speaker list responses

Секрет agent больше не отдаётся viewer/editor в GET/list speakers;
остаётся только при создании спикера.

Co-authored-by: Cursor <cursoragent@cursor.com>

internal/httpapi/speakers.go

@@ -39,7 +39,10 @@ func speakerJSONFromStore(st store.Backend, sp *store.Speaker) map[string]any {
 	if strings.TrimSpace(sp.MetaJSON) != "" && sp.MetaJSON != "{}" {
 		var raw map[string]any
 		if json.Unmarshal([]byte(sp.MetaJSON), &raw) == nil {
-			m["meta_json"] = raw
+			delete(raw, "agent_secret")
+			if len(raw) > 0 {
+				m["meta_json"] = raw
+			}
 		}
 	}
 	if meta.AgentDomain != "" {