docs(service-settings): the orphan-report note names keyedDigest for secret-valued keys

Co-Authored-By: Claude <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018zT8d8NpiQ1ExhuNd5TxY6

Author: claude

packages/services/service-settings/src/sys-secret-orphan-report.ts

@@ -36,7 +36,8 @@
  *    enumerable — it is every `secret`-typed field on every registered object,
  *    including tenant-authored ones.
  *  - ✅ The audit trail records digests, not handles (`old_hash` / `new_hash`
- *    are content digests; `SettingsService` passes the provider's `digest()`),
+ *    are content digests; `SettingsService` passes the provider's
+ *    `keyedDigest()` for secret-valued keys, `digest()` otherwise),
  *    so audit stays readable after a ciphertext is destroyed — and, the other
  *    way round, audit can never be used to reconstruct which handles existed.
  *