feat(cli,types): serve UI reads the declared title, and the secret detector stops flagging docs

[ABB65]

Two things this repository needed once title_field shipped, plus what fixing
them exposed in its own content.

serve-ui was still guessing

Its column list called Object.keys(desc.fields) under a comment claiming
that preserved definition order. It does not — model JSON is written with
canonically sorted keys, so it was alphabetical. That is the exact problem
order exists to fix: on a sixteen-field article model, author first and
title fifteenth, each column headed by its raw key (body_public,
is_category_hero).

• columns order by orderedFieldNames — a declared order wins, fields
  without one keep today's alphabetical fallback
• headers render resolveFieldLabel; the raw key stays as the title
  attribute so the underlying field is still discoverable
• default visible columns lead with title_field when the model declares one.
  The existing required-plus-simple-type heuristic fills the remaining slots
  and still covers models that predate the property

Both helpers come from @contentrain/types, so serve-ui and any other consumer
resolve them identically instead of each reimplementing the fallback chain.
serve-ui takes a workspace dependency on types — it is private and bundled, and
types is pure with no Node imports, so it bundles for the browser cleanly.

The secret detector was flagging documentation about secrets

SECRET_PATTERNS matched bare prefixes:

value	matched	is it a secret
task_id	sk_	no
risk_level	sk_	no
Authorization: Bearer <token>	Bearer	no
postgres://localhost:5432/mydb	postgres://	no
The api_key parameter is required	api_key	no

Seven of this repository's twelve validation errors were this — it stores
its own documentation as content, so every page explaining Bearer auth was a
finding. Same shape as the doctor --usage fix: a check firing correctly and
burying what matters.

Each pattern now matches a credential-shaped value rather than prose about
credentials — prefixes need their key body, a bearer token needs an actual
token rather than <token> / $TOKEN / {{token}} / YOUR_TOKEN, an api key
needs to be assigned one, a connection string needs embedded credentials.
18 cases are pinned in tests, taken from this repo's own docs.

Two pre-existing assertions changed rather than being worked around, because
they asserted the false positive: my_api_key_value and
mongodb://localhost/test are no longer reported. Both carry a comment saying
why. A check that fires on the wrong thing is not a strict check; it is one
people learn to scroll past.

What that exposed

Validation on this repo went 12 errors → 5, and the five are real. Running
validate --fix created the four missing tr.json files, which then surfaced
10 genuinely untranslated entries underneath. MCP correctly refuses to invent a
translation, so those stay reported.

The empty tr.json files are the right state: the locale is declared in
config, so the file should exist, and "these entries are untranslated" is more
actionable than "the file is missing".

The branch also carries [contentrain] validate: auto-fix — the transaction
advances the checked-out branch via update-ref alongside the content branch,
which is the documented design. The working tree was never touched.

Incidentally: the contentrain branch had all 11 models without title_field
and is now fully migrated, because every transaction merges base into its
worktree first. Worth knowing for the project migrations — a stale content
branch heals on the first write, it does not need separate handling.

pnpm lint, typecheck, vue-tsc, build, 1650+ tests, plugin:build,
release:check — all green.

🤖 Generated with Claude Code

[netlify]

✅ Deploy Preview for contentrain-ai ready!

Name	Link
🔨 Latest commit	d04947f
🔍 Latest deploy log	https://app.netlify.com/projects/contentrain-ai/deploys/6a7e3df6b00a4600095103c3
😎 Deploy Preview	https://deploy-preview-115--contentrain-ai.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.