fix(services): test connection merges stored secrets for blank fields

The credential tester (POST /api/services/test) used only body.secrets — the
values typed in the form. When editing an existing service the secret fields
are masked and intentionally left blank ("leave blank to keep current"), so the
test ran with empty credentials and failed auth even though the stored secret
was valid.

When body.id is set, look up the stored service, decrypt its secrets, and fall
back to the stored value for any known secret key that is absent or blank in
the input. The test still uses the freshly-typed config (so you can test an
edited URL) but authenticates with the effective credentials. New-service tests
(no id) are unchanged.

Test: editing a service and testing with empty secrets now authenticates with
the stored secret (asserts the stored key reaches the upstream request).
402/402 backend pass; ruff clean.

backend/tests/test_services.py

@@ -294,6 +294,39 @@ def test_update_service_can_clear_secret(client):
     assert updated["secrets_set"] == {"grafana_api_key": False}
 
 
+def test_service_test_uses_stored_secrets_when_not_reentered(client):
+    """Testing an existing service merges stored secrets for blank fields.
+
+    The editor leaves secret fields blank ("leave blank to keep current"); the
+    test must authenticate with the stored secret rather than failing on empty.
+    """
+
+    created = client.post("/api/services/instances", json=_prometheus_payload()).json()
+    assert created["secrets_set"] == {"grafana_api_key": True}
+
+    payload = SimpleNamespace(raise_for_status=lambda: None, json=lambda: {"results": {}})
+    with patch(
+        "media_library_viewer_api.integrations.prometheus.requests.post",
+        return_value=payload,
+    ) as mock_post:
+        res = client.post(
+            "/api/services/test",
+            json={
+                "id": created["id"],
+                "service_type": "prometheus",
+                "name": "Production Prometheus",
+                "config": {"grafana_url": "https://grafana.example.com"},
+                "secrets": {},  # not re-entered
+                "enabled": True,
+            },
+        )
+    assert res.status_code == 200
+    assert res.json()["ok"] is True
+    # The stored grafana_api_key was used for the request (not empty).
+    headers = mock_post.call_args.kwargs["headers"]
+    assert headers["Authorization"] == "Bearer secret-token"
+
+
 def test_unknown_service_type_rejected(client):
     response = client.post(
         "/api/services/instances",