ui: simplify SPA config callout to 3 sentences, align with field hints

The previous callout said "secrets must be re-entered on each full
save", which contradicted the field-level hint "leave blank; the
saved value stays". The actual contract: empty secret = keep saved
value (backend apply merge), required only on first setup.

Rewrite the callout (web/index.html + web/config.js, zh/en) to three
short sentences and make it consistent with secret.keepSet /
telegram.workerHint:
  - Secrets are stored server-side and never echoed.
  - Leave a secret blank to keep its saved value; required on first
    setup.
  - Other fields are read back automatically.

Dropped the "sent as <code>null</code>" sentence (too technical; field
hints already cover it) and removed the orphaned <code>null</code>
element. Dropped "always uses the primary account" -- the SPA has no
account_id field to move it to, so it is removed from the callout.

No JS logic changes; applyI18n just sets textContent on [data-i18n]
elements, so the <code> removal is safe. GATE-DOCS 6/6 PASS.

web/config.js

@@ -58,8 +58,8 @@
       "business.title": "Business connections and auth",
       "business.persist": "Encrypted in Redis",
       "callout.title": "Business configuration is encrypted in Redis.",
-      "callout.bodyPre": " Secret fields (app passwords, tokens) are not echoed and must be re-entered on each full save; non-secret fields are read back from the server. The first save must include all required secrets. Optional LLM fields are sent as ",
+      "callout.bodyPre": " Secrets are stored server-side and never echoed. Leave a secret blank to keep its saved value; secrets are required only on first setup.",
-      "callout.bodyPost": " when left blank. The mailbox primary account is always used.",
+      "callout.bodyPost": " Other fields are read back automatically.",
       "legend.business": "Full business configuration",
       "jmap.title": "JMAP mailbox",
       "jmap.desc": "The server must use HTTPS; the URL must not contain credentials, query parameters or fragments.",
@@ -273,8 +273,8 @@
       "business.title": "业务连接与鉴权",
       "business.persist": "Redis 加密保存",
       "callout.title": "业务配置以 Redis 加密保存。",
-      "callout.bodyPre": " 密钥字段（应用密码、Token 等）不会回显，每次完整保存需重新填写；非密钥字段会从服务器读回。首次保存必须包含所有必填密钥。可选的 LLM 字段留空时会发送为 ",
+      "callout.bodyPre": " 密钥保存在服务端，页面不回显。密钥留空表示保留已存值；首次配置时必填。",
-      "callout.bodyPost": "。始终使用邮箱主账户。",
+      "callout.bodyPost": "其余字段自动读回。",
       "legend.business": "完整业务配置",
       "jmap.title": "JMAP 邮箱",
       "jmap.desc": "服务端必须使用 HTTPS，URL 中不能包含凭据、查询参数或片段。",

web/index.html

@@ -79,7 +79,7 @@
           </div>
           <div class="callout callout-warning">
             <strong data-i18n="callout.title">Business configuration is encrypted in Redis.</strong>
-            <span data-i18n="callout.bodyPre"> Secret fields (app passwords, tokens) are not echoed and must be re-entered on each full save; non-secret fields are read back from the server. The first save must include all required secrets. Optional LLM fields are sent as </span><code>null</code><span data-i18n="callout.bodyPost"> when left blank. The mailbox primary account is always used.</span>
+            <span data-i18n="callout.bodyPre"> Secrets are stored server-side and never echoed. Leave a secret blank to keep its saved value; secrets are required only on first setup.</span><span data-i18n="callout.bodyPost"> Other fields are read back automatically.</span>
           </div>
 
           <form id="business-form" novalidate>