docs(backup): say what the secret-key hints actually refuse (#2656)

The comment called the hint list belt-and-braces over keys the collector
already refuses to write. It is not: _collect_settings filters exactly
bambu_cloud_token and auth_secret_key, so a current backup really does
carry mqtt_password, ldap_bind_password, ha_token and prometheus_token,
and the hints are the only thing that refuses them. The companion-
credential rule sits downstream of that, so reading the list as redundant
and shortening it would write a stale credential and make that rule inert
at the same time.

Comment and test docstring only - no behaviour change.

backend/tests/unit/test_github_restore.py

@@ -125,8 +125,9 @@ class TestSettingKeyBlocklist:
         Carving it out would also be a live hole rather than a tidy-up: an
         attacker-authored ``settings/app_settings.json`` could then get a
         ``*token*``-named row written simply by choosing that name. This
-        blocklist's whole job is belt-and-braces, so a name-shaped exception to
-        it is exactly the wrong shape of fix.
+        The hints are the primary refusal for every credential the collector
+        does not filter, so a name-shaped exception to them is exactly the wrong
+        shape of fix.
         """
         assert _is_blocked_setting_key("ha_token_from_env") is True