fix(setup): add Dingtian relay-password field + secure secret re-merge on test

The relay control password (relay_pw) was read by the driver but had NO form field,
so Test connection sent it as 0 → the device ignored the probe → a controller showed
"offline" even though it pinged. Add a "Relay control password" config field (secret;
blank keeps the stored value).

Because relayPassword is redacted from the client, the edit form can't resend it — so
the test endpoint now re-merges the stored secret by device id (mirroring save). It is
re-merged ONLY when the submitted config addresses the SAME device: matching driverId
and every connection-identity field it sets (host/port/binaryPort/httpPort/serial). A
redirected host/port or mismatched driver yields NO secret, so a probe can't exfiltrate
the password to an attacker host (the booth operator is the threat-model adversary).
testDevice() now passes the device id; setup-secrets.test.ts covers the identity guard.

Claude-Session: https://claude.ai/code/session_01Xcm6ikLgGoCxxHrxtjkk5V

packages/devices/src/drivers/access-dingtian.ts

@@ -779,6 +779,19 @@ export const dingtianDriver: AccessDriver = {
     { key: "binaryPort", label: "Binary protocol port", type: "port", required: false, default: 60000, help: "Dingtian binary protocol UDP port — authenticated relay control (default 60000)." },
     { key: "httpPort", label: "HTTP config port", type: "port", required: false, default: 80, help: "Device web/config-API port (default 80)." },
     { key: "channels", label: "Channels (relays/inputs)", type: "number", required: true, default: 4 },
+    {
+      // relay_pw — the BINARY-protocol control/status password (NOT the web-UI login
+      // below). Every relay command + the status read embeds it; with the wrong/no
+      // value the device silently ignores the packet → healthCheck times out → the
+      // controller shows "offline" even though it pings. Redacted from the client
+      // (SECRET_CONFIG_KEYS), so it renders as a secret: blank KEEPS the stored value
+      // (the server re-merges it on test/save); type a value to set/change it.
+      key: "relayPassword",
+      label: "Relay control password",
+      type: "secret",
+      required: false,
+      help: "Binary-protocol relay password (relay_pw). Leave blank to keep the current one; a wrong/missing value makes the device ignore commands (Test connection times out).",
+    },
     {
       key: "pulseMs",
       label: "Pulse open (ms)",