b5bf3ed8c0
loadConfig used CONFIG_SAFE_SELECT which excludes encryptedInboxCreds entirely, so username was never returned to the frontend — form always showed empty username. Added getConfigForApi() which loads the safe config + decrypts encryptedInboxCreds to extract username (never password) and adds hasPassword boolean. Controller getConfig now calls getConfigForApi instead of loadConfig. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>