Fix PocketID secret wiped on re-save; log token-exchange failures

save_pocketid_config cleared the stored client secret whenever the form was
submitted with a blank secret field — but the UI hint says blank means "keep
existing". Re-saving config (e.g. to set the allowed group) therefore wiped the
secret and broke token exchange ("Token exchange failed"). Now a blank field
keeps the existing secret; only a non-empty value overwrites it.

Also log PocketID's actual token-endpoint response body on failure so the cause
(invalid_client, redirect_uri mismatch, etc.) is visible in backend logs.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

milevault_export/backend/app/api/profile.py

@@ -154,8 +154,10 @@ async def save_pocketid_config(
         current_user.pocketid_issuer = body.issuer.rstrip("/") if body.issuer else None
     if body.client_id is not None:
         current_user.pocketid_client_id = body.client_id or None
-    if body.client_secret is not None:
-        current_user.pocketid_client_secret = body.client_secret or None
+    # Only overwrite the secret when a non-empty value is supplied; a blank
+    # field means "keep the existing secret" (matches the UI hint).
+    if body.client_secret:
+        current_user.pocketid_client_secret = body.client_secret
     if body.allowed_group is not None:
         current_user.pocketid_allowed_group = body.allowed_group.strip() or None
     await db.commit()